Preventing Users From Circumventing Group Policy

by Mitch Tulloch [Published on 24 Jan. 2006 / Last Updated on 24 Jan. 2006]

Given enough privileges, a user can often circumvent Group Policy restrictions. Here's what you can do about it.

If users have local admin privileges on their workstations, they can circumvent many Group Policy settings by editing the registry directly (provided they know enough to know where to look in the registry). This is bad news for administrators, and I'm often asked how they can prevent users from doing this. Here's a way one administrator does it on his network--it might work for you if your needs and environment are similar enough:

  1. Use software restriction policies to prevent users from running executables in any path except those you specify.
  2. Use Group Policy to restrict users from accessing the paths to executables in Windows Explorer.
  3. Use Group Policy to deny users access to the command prompt and regedit.
  4. Give users read-only mandatory user profiles.
  5. Use Group Policy to cause users' computers to forcibly log them off if Group Policy settings are not applied when they log on.

Combining these five restrictions together gives users very little wiggle room for doing things like installing unauthorized apps on their machines.

Mitch Tulloch

See Also

The Author — Mitch Tulloch

Mitch Tulloch is a well-known expert on Windows Server administration and cloud computing technologies. He has published over a thousand articles on information technology topics and has written, contributed to or been series editor for over 50 books.

Featured Links