im looking to add an account called "internet" so its just for browsing the web, and i dont want this user to be able to install any programs, use the cmd prompt or anything of the sort, even download things to the desktop, and i dont want the user to be able to have access to any of the programs that are installed as admin, like outlook, or office, etc. anyone have any tips on gettting started with this? im running windows 7 ultimate 64 bit.

Hi. This task could be pretty simple... If your creating this account on the local machine, not through a domain, then what you can do is first log on as the Admin of course. Now create a Standard User account through the applet in Control Panel-> User Accounts. You can Google or Bing about what restrictions and rights Standard users actually have. It's pretty slim. Now you can 'tweak' everything you need while logged on as the Admin. Go to the Start menu and type gpedit.msc in the search box. This will open the Local Group Policy Editor. You will have two tabs, Computer Configuration and User Configuration. If you expand Computer Configuration -> Windows Settings -> Security Settings, there are numerous rules you may apply, which are used for all users for that PC. For instance, you have the 'Application Control Policies'. From there you can take advantage of the Applocker application, which is a stand-alone feature of Ultimate, and set restrictions to whatever program, and whatever user. Also, if you want complete denial of your data, specific folders/files, or an entire drive, you may apply NTFS permissions by right-clicking the object to restrict and select 'Properties', and then the 'Security' tab. Click on "Edit", and find the User, or Group, and give them the necessary rights. You can use Bitlocker as well which allows you to encrypt a whole drive, or just files/folders you select. There is just a little taste of what you can do. Having Ultimate gives you every feature Windows 7 has to offer. If you need any more help please post back. =)- A+, Network+, MCTS - - Working on MCSA, Security+, CCNA, & others! -

Hi, I would like to share you the following article about AppLocker. You can configure Group Policy to prevent the user to install or use any programs. Alternatively, you can also use AppLocker. However, it may not prevent all programs. AppLocker Thanks, NovakPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.