Basic GP Help

[majesticmadman]

Hi All,

So I'm doing an appretiship in IT to learn more in the field, so I'm in my late teens.

I help a charity run with their computer mainly on a hardware and basic support. What I need to do is lock certain programs/functions of a user account but so that the admin can still access them.

So what I think would be easiest is a method to say that they can access a program rather than writing up all the ones they can't access.

I want to block their ability to write into all but a select few folders, so they can access files from there but can't place anything or edit those files.

I want to stop them from accessing the control panel (I know I can use gpedit.msc to disable it but that disables all accounts.)

Only be able to access the hand full of programs set by me.

Be unable to update windows or any of the other programs without password (Not sure if an standard non admin account prevents this anyway)

Thanks in advance,
Madman

 

[PopoChubbs]

I know that there are rules you can apply to profiles if you can create any on said PC(s). Permissions can be set so that users are more restricted than admins, which will be determined by what login info they enter to access the PC. Is that something you can implement with the PC you're working with?