Locking down a local machine

slipd · 10 Jun 2012 at 13:21

Hi guys,

I have several machines at work that are networked but have local user accounts on them that's fine but I would like to be able to lock them down a bit more

The only time a user uses the local account is for virtualbox and a few other bits and bobs that aren't on the network - I'd like to keep the host operating system as healthy as possible! Doesn't installing Group Policy Editor locally give me what I'm after?

It would be good if I could disable control panel/hide drives etc.

Thanks.

theheyes · 10 Jun 2012 at 15:17

You mean they have local administrator accounts?

slipd · 10 Jun 2012 at 15:20

Administrators have local admin accounts but the users using the machine only have the built in users accounts active

theheyes · 10 Jun 2012 at 18:20

A standard user account on the local machine is fine for keeping the general OS in a good state. They can only really screw over their own account. I've been doing it this way for years Windows 7 (if that's what you're using) strikes a good balance between what it allows users to configure on their own account.

You can still edit the local policy if you run gpedit.msc and tweak to your heart's content, but just be careful not to overdo it because you can end up generating more calls for yourself by hiding things that don't really need to be hidden.