SOLVED How to secure Control Panel?

[Sushi271]

Hi!

In few days I'm going to a summer sience camp, in which my notebook will be in use (some LaTeX or C++ lessons), that's why I'm securing it hardly, so kids couldn't mess up anything within. That's actually the first time I'm doing such thing, so help would be aprecciated. I already managed to deny access to both partitions of my disk for new user, and used Parental Control to block launching anything, but I have no idea how to block Control Panel, or anything like that?

TIA

 

[TrainableMan]

Turn off control panel

If you have Professional or Ultimate then you can use group policy editor to turn off control panel

 

[Sushi271]

Thanks, that'd be fine, however, it actually also blocks access to control panel for ME (Admin), what is mostly unwanted. Is there any way to do this only for particular users?

Edit:

Besides, someone can still enter that setting and unblock panel. Or enter regedit. Or something... Well, of course, maybe its too paranoic, but you never know...

Edit2:

On the other hand, I followed the link within the link you've gave me, and started to do something in the registry. But it's only for "Current User", so, if it's how I think, if I do this being logged on my account, it'll deny access to Control Panel for me, so I have to add this key in this user account, which I want to be cut out from Control Panel. But I was trying this, and adding any key/DWORD/anything to registry results in dialog saying: "Cannot add value: Error writing to the registry". Has it something to do with restrictions I could put before? But it appears even if I give this user full control to the system partition. Of course adding a key in my (admin) account works as fine as it should. So I'd rather prefer to add this key from my account, but in registry, in folder "HKEY_USERS" every folder is named as a line of numbers, kind of hash code or I don't know... So I have still no idea how to do this.

 

[TrainableMan]

First, you should create a separate user account for them & be sure to password yours. You would probably not want theirs to have admin privileges at all. Control Panel \ User Accounts. Set your password and create their account.

 

[Sushi271]

You've misunderstood me. This special low-privileges account already exists. I can log on to it without password, or on my own, but this one is protected with password. You should have expect, that it's done - after all it's rather simple and obvious when compare it to messing in registry, or permissions for disk partition (RMB on partition, properties, security tab) These all things are protected already. Only the Control Panel, and registry stands on my way to finish.

 

[TrainableMan]

You should have expect, that it's done - after all it's rather simple and obvious

It's best never to assume anything; if you have done this already, that is good.

Did you set the registry when you were logged on as the student? If you log on as the student is the control panel blocked? But if you log on as yourself then it is also blocked?

 

[Sushi271]

If I don't use registry, but gpedit - Control Panel is blocked for everybody. As it comes to registry - I can only set that key on my admin account, but on student's account I'm getting error which I've already written of. But one idea have just come into my mind - maybe that error occurs just cause the student's account is in Users group, not in Administrators (what is good of course) - so maybe I can change this registry entry by moving student to the Administrators group for a while, to move it out from there when it's done? I'm going to try it.

Edit:
Wow, that actually worked, I haven't been thinking seriously that it would! That means, that only the one in Administrators group can change any entry in registry, so even if someone manage to launch regedit, he won't be able to mess around! Thanks very much, problem solved!

 

[TrainableMan]

Actually, to use regedit while logged on as the student you would right click and select run as an administrator, at which point you would have to provide your info and then it should let you create the entry for current user but since you must have Professional or Ultimate the group policy editor is definitely easier.

Glad you got it worked out.