Lockdown by group using Local Computer Policy without Active Directory

You want to begin using some of the power of Active Directory’s Group Policy
Objects (GPO) but for many reasons, it is not available. You have been
experimenting with securing your Windows 2000 boxes using the Local Computer Policy. Its a lot easier and safer to than
registry hacks but you quickly learn that any policies set apply to everyone,
including the administrator. Almost never what you want. If the %systemdrive% is
NTFS, you can use NTFS file and directory permissions to get around this.
Windows 2000 and Windows XP ‘s Local Computer Policy
User policies depend on read access to the %systemroot%\system32\GroupPolicy folder. The trick: deny read
access to any group you do not want the local policies to apply. This technology
is limited in that you can only have two types of policies per system. This
doubles the default. You have to go to Active Directory GPO’s to implement a
fully feature security model.

• Set your policies via Local Computer Policy.
  If
  you haven’t used the mmc
  
  
  
  • Click Start | Run, type mmc and press enter
    Console1 window pops up
    
  • Click Console
    
  • Select Add/Remove Snap-in…
    
  • Click Add button
    
  • Scroll to Group Policy within the Add Standalone Snap-in dialog
    
  • Highlight Group Policy snap-in and click Add button.
    
  • Click Finish when prompted to finish with Local Computer as the Group Policy
    Object.
    
  • Click Close
    
  • Click OK
    Console1 window is back
    
  • Change console mode from author to user mode
    
    
    
    • Click Console
      
    • Click Options
      
    • Select User mode – limited access – single window
      from the Console change mode dropdown
      
    • Click OK (take defaults)
    
    
  • Click Console
    
  • Click Save As…
    
  • Enter name of choice for the console (my policy, wayne’s local policy,
    user policy, whatever
    
  • Click Save
    
  • Exit Console1
    
  • Edit the local policies as you need
    your user console is part of your
    Admin Tools
    
    
    
    • Click Start
      
    • Select Programs
      
    • Select Administrative Tools
      
    • Select Wayne’s Local Policy
      or whatever you called the mmc console
      
  
  
• Set NTFS permissions to explicitly deny read to folder %systemroot%\system32\GroupPolicy for the group you do not
  want tha policies to apply to.
  

  The %systemroot%\system32\GroupPolicy folder is
  hidden. You will have to change your folder options to display hidden files.
  

  
  
• If admin is excluded from the policies, logoff and back on.

This
technique can be very useful in kiosk or shared PC environments. This tips is
Windows 2000 and Windows XP compatible.

David sent me the following valuable addition:

However I ran into a problem… I made the
%SystemRoot%\system32\GroupPolicy\ accessable by Administrator so I could run
gpedit.msc and edit the policy file and then would make the directory
un-accessable by administrator once I was done. However, some policies take
place as soon as you enable them, and I ended up locking myself out of the
policy editor 🙂

If you go in Computer Configuration\Administrative Templates\System\Group
Policy and end enable “Turn off background refresh of Group Policy”, then
reboot, it makes using local policies a little easier. It won’t enable policies
until the user logs back in, so you don’t screw the Administrator account while
logged on as it mucking around with the policies.