How to configure the delimitation of certain privileges in a Windows XP local network?

Question

System administration

Hello dear IT community.
I have a task in front of me. Set up a local network of 15 PCs, all running Windows XP. One administrator PC and all other users. All requirements are clear to me. FTP server, internet censor, remote access and so on. But here is one moment. It is necessary to make it so that it would be impossible to change anything on the desktop. But only in a separate directory intended for storing employee files. At a certain time, this directory should be backed up on the admin's computer and archived. In addition, it is necessary that some programs and bat-files can be run by users, and some would require permission from the admin. How to implement this? Thank you in advance.

Answer 1

In NTFS rights (tab "Security in the folder properties) on the "Desktop" set the user to only "Read".
Archiving folders is a task in the scheduler / task scheduler.
With permissions to run, it is not clear how the procedure itself should go. There are two ways:
In the first case, nothing needs to be done, in the second case there are many options, but it all depends on why it is needed and which editions of Win XP are used (Home, Pro ...). As the simplest option, the user's rights to "Read and run" applications in NTFS are taken away, and then returned.

Answer 2

So this, active directory to help and go ...

Answer 3

www.oszone.net/4072_2
secedit, gpedit