Multiple Local Policies in Windows Vista

Group Policy is for sure one of the best inventions in Windows. Configuring multiple client computers has never been easier. And with Vista and Longhorn numerous extra settings will be available.

Group Policy really has only one limitation: it requires Active Directory.

And sometimes you can't (or you don't want to) use Active Directory, but you would like to create policies to control the things people can change or have access to on your pc.
For example, a kiosk computer, PCs in a cybercafé, your home machine (especially when the children are using it more and more).

In XP it is possible to use the Local Computer Policy to make changes to a single computer that is not part of a domain. And while you can implement the exact same settings as with group policy, there is one serious drawback.
You cannot make exceptions to policy settings for individual users. Once the policy is applied, it will enforce restrictions for everyone, including the Administrator.

But now there is Vista!
And one of the great new things in Vista is that you can create multiple local policies! Different policies per user. Or you could create 1 policy for the Administrators and another one for the Non-administrators.
It is very easy to limit everyone accessing your computer, except for yourself!

This is the way to go:

1. Open a Management Console.
2. Add the Group Policy Object Editor snap-in.
3. In the "Local Computer" policy window, click Browse.
4. Click on the Users tab.
5. Select the user that you want to create a policy for.
6. Configure the settings that you want to apply for this individual user.

Note: the only users you see are local users. Besides the users you will also find the local Administrators group and the non-administrators group.

If multiple policies apply, the end result wil be a combination of these policies and the user policy will win in case of conflicts.
For example: User 1 is a normal user (no administrator). You create an individual Local policy for user 1 that prohibits access to the Control Panel and explicitly allows him to access Search from the Start Menu.
You also create a policy for the Non-Administrators, that removes the Search from the Start Menu.

When user 1 logs on, both policies will be applied, but user 1's policy will override the conflicting Search setting in the Non-Administrators policy.
End result: user 1 has no access to Control Panel, but he will be able to use the Search from the Start Menu.