# How can I limited XP software access to regular users?

**URL:** <https://boards.straightdope.com/t/how-can-i-limited-xp-software-access-to-regular-users/274868>\
**Category:** Factual Questions\
**Created:** [November 15, 2004, 3:48pm UTC](https://boards.straightdope.com/t/how-can-i-limited-xp-software-access-to-regular-users/274868 "2004-11-15T15:48:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JThunder](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@JThunder](https://boards.straightdope.com/u/JThunder)\
**Post date:** [November 15, 2004, 3:48pm UTC](https://boards.straightdope.com/t/how-can-i-limited-xp-software-access-to-regular-users/274868/1 "2004-11-15T15:48:45Z")

</div>

Our company has an application wherein we would like to restrict which programs a regular (i.e. non-administrator) user can access. In effect, we would like to make sure that they only use four or five programs on this computer, making it a fancy front-end interfacer rather than a general-purpose computer.

The tricky part is that we don’t want the _Administrator_ account to have the same restrictions. We tried using group policies, but this crippled both the admin and the non-admin accounts.

Any suggestions?

---

<div class="post-metadata">

**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\
**Post date:** [November 15, 2004, 6:44pm UTC](https://boards.straightdope.com/t/how-can-i-limited-xp-software-access-to-regular-users/274868/2 "2004-11-15T18:44:32Z")

</div>

You apply permissions at the File level. Take Excel for an example.

You create a global group called Excel Users.  
You create a local group called App-Excel  
On each machine you right-click Excel.Exe and set the permissions to:

Local Machine ID\Administrators: F(ull)  
Local Machine ID\App-Excel: R(ead) (e)X(ecute)

This can be done programatically using _cacls.exe_

Add the global group to the local group.

Now just add those you want to be able to use Excel to the global group and you’re done.