Preventing Users From Circumventing Group Policy

Written by on Wednesday, March 5, 2008 5:26 - 0 Comments
Given enough privileges, a user can often circumvent Group Policy restrictions. Here’s what you can do about it.
If users have local admin privileges on their workstations, they can circumvent many Group Policy settings by editing the registry directly (provided they know enough to know where to look in the registry). This is bad news for administrators, and I’m often asked how they can prevent users from doing this. Here’s a way one administrator does it on his network–it might work for you if your needs and environment are similar enough:

  1. Use software restriction policies to prevent users from running executables in any path except those you specify.
  2. Use Group Policy to restrict users from accessing the paths to executables in Windows Explorer.
  3. Use Group Policy to deny users access to the command prompt and regedit.
  4. Give users read-only mandatory user profiles.
  5. Use Group Policy to cause users’ computers to forcibly log them off if Group Policy settings are not applied when they log on.

Combining these five restrictions together gives users very little wiggle room for doing things like installing unauthorized apps on their machines.


Article written by

Leave a Reply

You must be logged in to post a comment.

2003 server - Sep 30, 2008 22:34 - 0 Comments

instant messaging srv records

More In Computers & PC

Microsoft Outlook - Mar 22, 2009 11:22 - 0 Comments

Outlook: Duplicates in Mailbox

More In Computers & PC