You can control what other accounts can do on your computer in a few different ways. In this section we'll show you some tweaks in the Group Policy Editor and also show you how to restrict access to the Control Panel, which will stop other people from fiddling about with such important things as your System Settings.
21. Use Group Policy Editor
Windows XP Professional Edition includes the Group Policy Editor, which is a very powerful tool that enables you to configure what permissions and access each account has. This isn't available in the Home Edition.
To launch it, Choose 'Start > Run' and enter gpedit. msc in the 'Open' bar. Click 'OK'. Expand 'User Configuration' in the left-hand pane. You'll see subfolders for 'Software settings', 'Windows settings' and 'Administrative templates'.
By expanding these, you can find a range of options to configure. Expand 'Administrative templates', followed by 'Control panel'. Here you can alter what appears in the user's control panel.
One particularly useful setting is the one that prohibits access so you can stop other users changing your settings. Double-click 'Prohibit access to the control panel' in the right-hand pane. This opens a dialog. Select 'Enabled' and click 'OK'. Choose the 'Explain' tab to find out more about this setting.
Each setting listed here has three options for configuration. 'Not configured' means you'll make no change to the current setup. 'Enabled' turns the setting on, and 'Disabled' turns it off again. It's worth exploring the various configurations you can make, but make sure you're fully backed up before you do so.
22. Restrict folder access in Group Policy Editor
In Group Policy Editor you can restrict folder access by disabling Simple File Sharing and then right-clicking the folder you would like to protect and selecting 'Properties'. Move to the 'Security' tab and you're ready to restrict folder access.
Now 'Add' and then select the user you would like to restrict. Tick the top box in the 'Deny' column to prevent the selected user from accessing, viewing or modifying the files in the folder you selected.
23. Restrict hard drive access in Group Policy Editor
You can restrict access to certain hard drives by clicking 'Start > Run', typing 'gpedit. Msc' and pressing [Enter]. In the User Configuration section, you'll need to navigate to 'Administrative Templates\Windows Explorer' to choose the hard drives you want to restrict.
24. Lockdown the Start menu
To restrict access to the Start menu, navigate to the Start menu and taskbar section and you can add restrictions. Disabling the Run command and search function can help prevent other users from locating system files.
Note: You may find that the changes you make in the Group Policy Editor do not seem to be carried out immediately. You can force a refresh of the settings by opening a command prompt ('Start > Run' and type 'cmd') and typing 'gpupdate' before clicking [Enter].
If you find you can't access the Group Policy Editor (gpedit.msc), make sure that you're logged on as an administrator, since limited accounts can't access this tool. Remember, Group Policy Editor is only included with Windows XP Professional.
25. Limit control panel access
Before you disable any Control Panel items, we advise creating a shortcut for easy access. Open the Control Panel, highlight all the applets and drag them to your desktop to create shortcuts. If you're using Windows XP Home Edition, you'll need to edit the Registry to disable access to certain Control Panel applets. Click 'Start > Run', type 'Regedit', then click 'OK'.
Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer. Click 'Edit > New > DWord Value' and name it 'DisallowCpl'. Give it a value of 1.
To disable applets in the control panel go to 'Edit > New > Key' and name it 'DisallowCpl'. Click 'Edit > New > String' and name it '1'. Double-click to set the value to the name of the applet to disable using the list in the box above.
Beneath the Control Panel tree entry you'll see four more folders that you can use in order to customise which Control Panel tabs are made available.
26. Encrypt an entire folder
Instead of restricting other users you could always just encrypt important folders in Windows XP. You need to select the folder to encrypt by right-clicking 'Start > Explore'. Navigate to the directory then right-click it and select 'Properties'.
Click 'Advanced' and check 'Encrypt Contents' to secure data. Click 'OK > OK'. This will encrypt the currently selected folder. Windows XP can apply this setting to just the files contained or to all the files and folders.
You'll be prompted to confirm whether you wish to apply encryption to just the selected folder, or to also encrypt its subfolders. Choose the option that suits you and then click 'OK'. In Windows XP it's easy to tell which files have been encrypted - all encrypted files are coloured green, and compressed files are blue.
Note: Encrypting File System (EFS) is part of Windows XP Professional, but not the Home Edition.
