Can I somehow password protect Local Group Policy?

GoodTimesAhead · 14 Dec 2016

So here's my issue. I want to block some programs from ever running on the computer. I do that either by using applocker or Software Restriction policies blocking the name of the executables and their digital signature which works great.

The problem is I don't want to make a standard user account for the other users (whom I'm trying to prevent from using these programs) since we use a lot of programs that share settings which would make it incredibly inconvenient. Also I want the other users to be able to install programs freely without the administrator's permission.

So my question is is there a way to lock someone out of local group policy or playing with the registry without making a new account?

Barman58 · 14 Dec 2016

Have you thought about the default user?

If you set-up the default user profile with all the applications and you set them up you can then create standard users for each user and their accounts will be set-up as a copy of the daufult user profile including the apps and settings, you can then further control the security using local group policy, other than this you really need a server to handle security (which I know is not always a financially viable option.

Default User Profile - Customize in Windows 10 - Windows 10 Tutorials

You can also set up your own user and then make that the default user, although that is a little more complex

Customize the Default User Profile by Using CopyProfile

GoodTimesAhead · 14 Dec 2016

Thank you for the reply.
I will give the default user a try and see how that goes.

GoodTimesAhead · 14 Dec 2016

Is there a way to give standard users a little more leeway? I'm testing how standard users account work and every program I try to run is asking me for admin's password? Also tried to turn UAC off but I don't think it's possible as it's grayed out.