Hi everyone first post here, and first time here as well. Thank you.

I am trying to "lock down" standard user accounts from being able to use the control panel sop they cannot change settings on a shared work computer. I created the account and went into grpedit.msc and "enabled" the lockout control panel option (don't remember exact verbiage) and when I restarted the computer All the accounts were locked from the control panel.

So I "unhid" the main Administrator account and tried with it and it was also locked out. The only way I could fix this issue was to get back into grpedit.msc and undo the option to hide. So now Id like to know how I can do this. Basically the business owner wants to just block certain stuff from "public users" so they cant install/uninstall or get into settings etc etc.

Maybe there is a better way of doing this? Can anyone shed some ideas or provide alternative options...the customer wants it simple and non confusing as possible..small business..nothing fancy.

Thank you so much for any help you can provide.