I have worked in IT (Information Technology) for more than 10 years now, and if there is one thing I have learned it’s that people like to mess around with their computers both at work and at home. This is why most IT staffs will lock down work computers and limit the user’s capacity to do anything other than run programs. In this article, I’ll tell you how to lock down a Windows XP Professional computer using the built-in Group Policy Editor.
The ‘Group Policy’ name might be a little confusing, because you’ll be using this Group Policy Editor to change local settings. This means that whatever settings you put in will only affect users logged into that particular computer, and will not carry over to any other PCs. These settings apply to everyone, including Administrator account logins.
To load the Group Policy Editor, go to Start – Run, and type gpedit.msc and click OK. You’ll have a variety of options available to enable or disable nearly every aspect of the look and function of Windows XP Professional. To enable/disable an option, just double click on it. Below you will find some of my recommended settings.
User Configuration – Administrative Templates – Desktop:
Hide and Disable All Items on the Desktop – This will remove everything from the desktop, and you can’t even right-click on it any more. Follow the on-screen advice for removing the Desktop option from the Places menu so that users won’t have the option to access the Desktop from Open/Save menus.
User Configuration – Administrative Templates – Desktop – Active Desktop:
Enable Active Desktop – You need to first enable this in order to set a desktop background.
Active Desktop Wallpaper – Enable this and then set your own wallpaper. This will make the Desktop wallpaper the same no matter who is logged in. Users may complain about not being able to set their own background, but having a nice company logo is often better than the family photos, comic book characters, or scantily clad women that often end up on machines.
User Configuration – Administrative Templates – Control Panel – Display:
Prevent Changing Wallpaper – Enable this option so that the user can’t change the wallpaper. If they go into the Display properties, the window and buttons will be grayed out. Be sure to enable this option if you are manually setting your own wallpaper with Active Desktop.
User Configuration – Administrative Templates – Control Panel – Display – Desktop Themes:
Remove Theme Option – Enable this option to keep people from changing the theme, which controls the look of nearly everything in Windows. This will help to prevent people from setting weird color schemes and other customized looks that some people like to put on their machine.
