Windows PowerShell and GPO

Deploying with SCCM has nothing to do with UAC.  UAC only counts when you are logged into the machinelocally.

The script you are running is set of batch commands that can be executed by SCCM.  ALl of these commands can also be done using POwerShell remnotely which also does nnot require UAC elevation.

None of the scenarios you describe indicate that UAC is your problem.

If run under SCCM it will be silent. SCCM runs elevated always.

This is a process that only ever gets run once. Wy is it a problem to have to eleavter.  Just choose to right click runas.  Running silently locally would only be required if you were trying to make something happen that shouldn't happen.

Use the PowerSHell sIIS 7 shell to run all of those commands remotely or even WMI remotely assuming you ae an administrator.  Remote operations with the administrator account do  not trigger UAC.

Using PowerShell remotely:

blogs.technet.com/  updating-group-policy-on-a-dark-and-stormy-night

for those not on 2008 R2 please see
jfrmilner.wordpress.com/ configure-powershell-remoting-using-group-policy

--------------------

Group Policy

As you may know, Windows PowerShell 2.0 introduced a new remoting feature, allowing for remote management of computers.

While this feature can be enabled manually (or scripted) with the PowerShell 2.0 cmdlet Enable-PSRemoting, I would recommend using Group Policy whenever possible. This guide will show you how this can be accomplished for Windows Vista, Windows Server 2008 and above. For Windows XP and Windows Server 2003, running Enable-PSRemoting in a PowerShell startup script would be the best approach.

Windows PowerShell 2.0 and WinRM 2.0 shipped with Windows 7 and Windows Server 2008 R2. To take advantage of Windows PowerShell Remoting, both of these are required on the downlevel operating systems Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008. Both Windows PowerShell 2.0 and WinRM 2.0 are available for download here, as part of the Windows Management Framework (Windows PowerShell 2.0, WinRM 2.0, and BITS 4.0). To deploy this update to downlevel operating systems I would recommend to use WSUS, which are described in detail in this blog post by Kurt Roggen.

Group Policy Configuration

Open the Group Policy Management Console from a domain-joined Windows 7 or Windows Server 2008 R2 computer.

Create or use an existing Group Policy Object, open it, and navigate to Computer Configuration->Policies->Administrative templates->Windows Components

Here you will find the available Group Policy settings for Windows PowerShell, WinRM and Windows Remote Shell:

To enable PowerShell Remoting, the only setting we need to configure are found under “WinRM Service”, named “Allow automatic configuration of listeners”:
More at link
-----------------------
Installing Roles and Features remotely on multiple computers simultaneously

"Turn Off Computer" option is missing from Start Menu

READ it first!
Turn off Computer missing
For XP Professional:
- Click [Start] [Run] type [Gpedit.msc]
- [User Configuration] [Administrative Templates] [Start Menu and Taskbar]
- In the right pane, double-click "Remove and disable the Turn off computer
button" and set it to "Not Configured"
- Set "Remove and prevent access to Shutdown command" to "Not Configured"
- Restart
More information:
http://support.microsoft.com/default.aspx?kbid=307882
For XP Home:
Open Registry Editor (Regedit.exe)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Set the NoClose value to 0
http://is-it-true.org/nt/xp/registry/rtips41.shtml

Ramesh ( SRamesh2k.RemoveThis@hotmail.com)
http://www.angelfire.com/dragon/sramesh2k/

---

Special Solution

---

Source
When you click Start Menu, the Turn Off Computer option may be missing. This is due to a group policy / registry restriction. To restore the missing option, try this - for stand-alone systems:
Resolution
NOTE: Backup the Registry before modifying. See this article for more information.

• Open Registry Editor by typing REGEDIT.EXE in the Start, Run dialog.
   
• Navigate to the following locations:

HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer

-and-

HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer

• In the right-pane, double-click the value NoClose and set it to 0.
  
• Restart Windows for the changes to take effect

---

Source
Solution:
Disable the NoClose Group Policy from the registry.
(Note: Local Machine Administrator Rights may be required)
Read More
Launch RegEdit.

Navigate to the following location:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

In the right-pane, double-click the value NoClose and set it to 0.



Navigate to the following location:
[LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

In the right-pane, double-click the value NoClose and set it to 0.



Restart Windows for the changes to take effect

Registry Editor
Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
Value Name: NoClose
Data Type: REG_DWORD
Value: 0
Key: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
Value Name: NoClose
Data Type: REG_DWORD
Value: 0

---

To restore the Group Policy with No Turn Off Computer Option.

Launch RegEdit.

Navigate to the following location:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

In the right-pane, double-click the value NoClose and set it to 1.



Navigate to the following location:
[LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

In the right-pane, double-click the value NoClose and set it to 1.



Restart Windows for the changes to take effect

Registry Editor
Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
Value Name: NoClose
Data Type: REG_DWORD
Value: 1
Key: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
Value Name: NoClose
Data Type: REG_DWORD
Value: 1

Policy settings for the Start menu

Policy settings for the Start menu in Windows XP

You can use the Group Policy editor (Gpedit.msc) under the following location to configure Start menu features:

User Configuration \ Administrative Templates \ Start Menu and Taskbar

Note: Except when noted, all of these registry settings are under the following registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

The registry entries are DWORD values. A value of 1 is enabled, and a value of 0 is disabled.

Policy:Disable the new simple Start Menu
Description:Disables the new simple Start menu and forces the classic 
Start menu.
Registry Value:"NoSimpleStartMenu"

Policy:Remove pinned programs list from the Start menu
Description:Removes the pinned programs list from the Start menu. Also 
removes the Internet and E-mail checkboxes from the Start menu 
customization CPL.
Registry Value:"NoStartMenuPinnedList"  

Policy:Remove frequent programs list from the Start Menu
Description:Removes the frequently-used programs list from the Start 
menu.
Registry Value:"NoStartMenuMFUprogramsList"

Policy:Remove More Programs list from the Start menu
Description:Removes the More Programs list from the Start menu.
Registry Value:"NoStartMenuMorePrograms" 

Policy:Remove common program groups from Start Menu
Description:Removes items in the All Users profile from the More 
Programs list on the Start menu.
Registry Value:"NoCommonGroups" 

Policy:Gray unavailable Windows Installer programs Start Menu shortcuts
Description:Displays partially installed programs in gray text on the 
Start menu.
Registry Value:"GreyMSIAds" 

Policy:Disable and remove links to Windows Update
Description:Removes the Windows Update link from the More Programs list 
in Start menu, from the Tools menu in IE, and blocks user access to 
windowsupdate.Microsoft.com.
Registry Value:"NoWindowsUpdate" 

Policy:Remove user folders from the Start Menu
Description:Removes all user-specific folders except My Documents (My 
Pictures, My Music, Favorites, and Recent Documents) from the Start menu. 
Also removes the corresponding checkboxes from the Start menu 
customization CPL.
Registry Value:This is a combination of the following: 
"NoStartMenuMyMusic", "NoSMMyPictures","NoFavoritesMenu",
"NoRecentDocsMenu" 

Policy:Prohibit user from changing user folder paths
Description:Prevents users from changing the path to the My Pictures, 
My Music, Favorites, and Recent Documents folders.
Registry Value:"DisableMyPicturesDirChange", "DisableMyMusicDirChange", 
"DisableFavoritesDirChange".

Policy:Remove My Documents folder from the Start Menu
Description:Removes My Documents folder from the Start menu and 
corresponding checkbox from the Start menu customization CPL.
Registry Value:"NoSMMyDocs"

Policy:Prohibit user from changing My Documents path
Description:Prevents users from changing the path to the My Documents 
folder.
Registry Value:"DisablePersonalDirChange" 

Policy:Remove Recent Documents item from Start Menu
Description:Removes the Recent Documents folder from the Start menu. Also 
removes the corresponding checkbox from the Start menu customization CPL.
Registry Value:"NoRecentDocsMenu"  

Policy:Maximum number of recent documents
Description:Specifies the number of shortcuts displayed on the Recent 
Documents submenu.
This policy exist under the following location in Group Policy: 

User Configuration \ Administrative Templates \ Windows Components
Registry Value:"MaxRecentDocs"  

Policy:Clear history of recent documents on exit
Description:Deletes all shortcuts shown in the Recent Documents menu when 
the user logs off.
Registry Value:"ClearRecentDocsOnExit" 

Policy:Remove Favorites item from Start Menu
Description:Prevents users from adding the Favorites item to the Start 
menu. Also removes the corresponding checkbox from the Start menu 
customization CPL.
Registry Value:"NoFavoritesMenu" 

Policy:Remove My Computer from the Start Menu
Description:Removes the My Computer item from the Start Menu and the 
corresponding checkbox from the Start menu customization CPL.
Registry Value:"{20D04FE0-3AEA-1069-A2D8-08002B30309D}" under 
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum. 

Policy:Remove Network Connections from the Start Menu
Description:Removes the Network Connections item from the Start menu 
and the corresponding checkbox from the Start menu customization CPL.
Registry Value:"NoNetworkConnections" 

Policy:Remove Network Places from the Start Menu
Description:Removes the Network Places item from the Start menu and the 
corresponding checkbox from the Start menu customization CPL.
Registry Value:"NoStartMenuNetworkPlaces" 

Policy:Do not add shares of recently used documents to Network Places
Description:Remote shared folders are not added to Network Places whenever
you open a document in the shared folder.
Registry Value:"NoRecentDocsNetHood" 

Policy:Remove Help item from Start Menu
Description:Removes the Help item from the Start menu, but does not 
disable Help files from running.
Registry Value:"NoSMHelp" 

Policy:Remove Search item from Start Menu
Description:Removes the Search item from the Start menu and disables some 
Windows Explorer search elements.
Registry Value:"NoFind" 

Policy:Remove Run item from Start Menu
Description:Removes the ability to execute programs from the Run option 
on the Start menu, Task Manager, or by pressing Winkey + R. Also removes 
the corresponding checkbox from the Start menu customization CPL.
Registry Value:"NoRun" 

Policy:Add "Run in Separate Memory Space" check box to Run dialog box
Description:Allows 16-bit programs to run in a dedicated Virtual DOS 
Machine (VDM) process.
Registry Value:"MemCheckBoxInRunDlg" 

Policy:Do not use the search-based method when resolving shell shortcuts
Description:Prevents the system from conducting a comprehensive search of 
the target drive to resolve a shortcut.
Registry Value:"NoResolveSearch" 

Policy:Do not use the tracking-based method when resolving shell shortcuts
Description:Prevents the system from using NTFS features to resolve a 
shortcut.
Registry Value:"NoResolveTrack" 

Policy:Force Logoff to the Start Menu
Description:Forces the Logoff button to the Start menu and prevents users 
from removing the Logoff option from the Start menu.
Registry Value:"ForceStartMenuLogoff" 

Policy:Disable Logoff on the Start Menu
Description:Removes the "Logoff" button from the Start menu and prevents 
users from adding the Logoff button to the Start menu.
Registry Value:"StartMenuLogoff" 

Policy:Disable and remove the Turn Off Computer button
Description:Removes the "Turn Off Computer" button from the Start Menu and
prevents shutting down Windows using the standard shutdown user interface.
Registry Value:"NoClose" 

Policy:Disable and remove the Undock PC command
Description:Removes the "Undock PC" button from the Start Menu and 
prevents undocking of the PC (laptop).
Registry Value:"NoStartMenuEjectPC" 

Policy:Disable drag-and-drop menus on the Start Menu
Description:Prevents users from modifying the Start menu by dragging and 
dropping items. Other methods of customizing the Start menu are still 
enabled.
Registry Value:"NoChangeStartMenu" 

Policy:Disable changes to Taskbar and Start Menu settings
Description:Removes the Taskbar & Start Menu item from the Control 
Panel, and removes the Properties item from the Start menu (and button) 
context menu.
Registry Value:"NoSetTaskbar" 

Policy:Disable user tracking
Description:Prevents the system from remembering the programs run, paths 
followed, and documents used.
Registry Value:"NoInstrumentation" 

Policy:Remove user name from Start Menu
Description:Removes the user name from the Start menu.
Registry Value:"NoUserNameInStartMenu"

Security in Internet

Source
...
Group Policies
The last thing that I want to talk about is how you can prevent spyware from infesting your network by making effective use of group policies. As you probably know, group policies are designed to configure the security settings of each workstation as it attaches to the network. What a lot of people don’t realize is that you can control Internet Explorer’s configuration directly through a group policy.

The Internet Explorer related group policy elements can be found by browsing through the group policy tree to User Configuration | Windows Settings | Internet Explorer Maintenance | Security, as shown in Figure A.

Figure A: You can configure Internet Explorer’s security settings through a group policy.

If you double click on the Security Zones and Content Ratings option, you will see a screen that gives you the chance to customize the security and privacy settings. Select the Import the Current Security Zones and Privacy option, click the Modify Settings button, and you will see the familiar Internet Options properties sheet, shown in Figure B. The thing about this properties sheet though is that the settings that you enter will apply to every user that the group policy applies to (assuming that a higher level policy doesn’t block the settings).

Figure B: The Internet options Properties Sheet can be used to configure Internet Explorer for all of your users.

The actual settings that you implement are up to you, but I recommend setting the Internet zone to Medium security, but also blocking any and all ActiveX controls. I recommend setting the Restricted Sites zone to High Security. I also recommend periodically adding known malicious sites to the Restricted Sites zone. There are a lot of places on the Internet where you can download lists of Web sites that are known to be malicious. I also like using a free utility called Spyware Blaster (http://www.javacoolsoftware.com/spywareblaster.html) because it contains its own list of malicious sites. You can copy the list of malicious sites from Spyware Blaster into the Restricted Sites zone.
...

Internet Explorer blocking

Source

Internet Explorer blocking (per user account)
Create a new "OU" call it something like "Restricted" then create a gpo and call it "No_Internet" then add the following policies:
1. user configuration\windows settings\internet explorer
maintenance\connection then choose proxy settings put a check box in proxy settings and put a dead ip or server name in the field and change the port to 8080 (set all fields to use these parameters)
2. administration template\windows components\internet explorer\internet
control panel enable "disable connection page."
3. move the few restricted users into the restricted ou they should inherit the parent gpo (if any)
NOTES
refresh the client gp by rebooting or typing for winxp gpupdate /target:user or win2k secedit /refreshpolicy

READ

---

I am the Admin for a Windows 2000 pro computer with two power user accounts.
This PC is not on a domain controller.
I need a solution that will allow power user A to have internet access via internet explorer and disallow power user B internet access via internet explorer. I am looking for the solution to limit internet access (If need be network access) when power user B is logged on the PC. Both accounts need to be operating as power user because of the graphics software won't operate otherwise. Someone of the part-time employees downloading spyware junk atomic clock and calendar with gator.com operating in the background and I want to put an end to that with my request as stated above.

"Curtis Clay III [MSFT]"
you maybe able to configure a local group policy wich denies access to the internet and then deny access to that policy for the user and administrator so that you 2 can have internet access.
See below...
Deny Read and Execute to the Administrator and Power User accounts to the following files
%systemroot%\system32\Group Policy\gpt.ini
%systemroot%\systerm32\GroupPolicy\User\Registry.pol
Create a second administrator account called GPOADMIN. This account will continue to get policy but will be able to administer and change the policy, since the original Administrator account will get access denied when trying to open the policy in the MMC. Use the GPOADmin account only to change or edit the policy.
If the original administrator account gets read and execute permissions restored, it will immediately begin to download and apply policy.
If the policy locks down the desktop, make sure to place a shortcut to the mmc and Group Policy snap in on the desktop of the GPOAdmin profile so he can access the policy. (i.e. the run and program menus are restricted by the policy)

---

Source

Disable Internet Access (All Windows)

This tweak can be easily applied using WinGuides Tweak Manager.
Download a free trial now!

By using this tweak you are able to restrict access to the Internet when using Internet Explorer and other Microsoft compatible products such as Office.

Open your registry and find the key below.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

Change the value of "ProxyEnable" and set it to "1". Change the value of "ProxyServer" and set it to an IP address and port that is invalid on your network such as "10.0.0.1:5555" (i.e. "IP:Port").

By changing these settings Internet access will be disabled for any applications that rely of the Microsoft proxy server information such as Internet Explorer, Microsoft Office, Opera browser.

To stop users from modifying the proxy settings add these restrictions to disable changes to the Internet configuration.

Find or create the key below:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]

Create two DWORD values named "Connection Settings" and "Connwiz Admin Lock" and set them both to "1".

To remove the restriction, set the proxy settings back to their original values and delete the policy values.

Note: The change will take effect immediately for any new browser windows, existing Internet Explorer sessions will not be affected until the browser is closed and reopened.

		(Default)	REG_SZ	(value not set)
		ProxyEnable	REG_DWORD	0x00000001 (1)
		ProxyServer	REG_SZ	10.0.0.1:5555

	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\...

Registry Settings

User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Internet Settings]
Value Name: ProxyEnable, ProxyServer

Group Policy to restrict Internet Access

Source

Internet Explorer Maintenance is used to manage and customize Internet Explorer on computers running Windows 2000 or later. You can enable Internet access options such as the Browser UI, connections, URLs, proxy settings, security zones, Favorites, and Internet Explorer Enhanced Security Configuration component.

This article descript how to use Group Policy to restrict Internet Access by assigning a fake IP to proxy. In our case, you have some clients accessing your system using Terminal Services and would like to restrict them to access the Internet except local Web server from the TS server.

To setup Group Policy to restrict Internet Access, follow these steps.

1. Open Group Policy by running gpedit if you use local group policy or running Active Directory Users and Computers to create a group policy.

2. Click User configuration>Windows Settings>Internet Explorer Maintenance>Connection (Figure).

3. Right-click on Proxy Settings and then Properties.

4. Check enable proxy Settings and type a fake IP address, for example 192.168.2.100 on HTTP (you don't have a proxy server or the proxy server is using the different IP).

5. Under exception, type the web server IP address, for example 192.168.2.10 (Figure).

6. Test it.

Related Topics

Configure Group Policy Object for Terminal Services Servers

Disabling (serverside) Internet access on clients

Source

So Many Roads

Corporate employee policy is absolutely necessary for this (and plenty of other IT-related) issue(s). Enforcement in a cubicular environment obviously depends on a variety of factors.
A proxy-defining script is very attractive. I've met with good success with security by obscurity, not the least notable of which has been renaming Explorer.exe (&/or Netscape) and/or assigning appropriate rights to the file. You can also use your firewall/AV app to monitor downloads or iterations of alternate browsers.

Why not keep it simple

Just give static addresses and do not specify any gateways or DNS. Adjust priviledges so they can't change these settings and they can still use shared printers and resources, but cannot get off of the network. This should be sufficient for the average user that has very little knowledge of how the network is put together.

Simple is fun

add an entry to the PC's hosts file pointing the proxy server to null
127.0.0.1 yourproxyserver
users do not have rights to edit the file.

how about?

when I want keep the kids from spending the night on the net, I go to RUN>CMD>IPCONFIG/RELEASE to stop the browser.

When I want to turn it back on,

RUN>COM>IPCONFIG/RENEW

Try GPEDIT.MSC...

Edit the local group policy on the PC to dis-allow iexplore.exe from running, use 'Add/Remove Programs' to remove all access to Internet Explorer and move the shortcut to Windows Update from the '\Documents and Settings\All Users\Start Menu' to the desktop of the local administrator's profile.
All of my users are running as 'Restricted Users' (no user should even have 'Power User' rights), so this works very well.

block port 80

Hi. If you are using XP, you can create a security policy in computer management to block all traffic on port 80. This will kill internet access and nothing else (and requires admin rights to change) and does it does not matter what browser you use.

Account restrictions

Simply applying your GPO & even some of the other tips here without applying account restrictions does not deal with Domain Accounts with mail services.
The easiest way would be to simply setup a domain local group for firewall users & that would end the surfing.

Yeah, well that's all fine and dandy...

You can also cut the wave out from underneath most surfers just by not allowing iexplore.exe to be run in gpedit.msc.
We are implementing SharePoint and blocking port:80 and cutting off gateways and using bogus proxy servers won't cut it for us.
Simple is good, but (as I've tried these solutions before) I find I wind up hosing somebody in the all-or-nothing solutions.
XP SP2 offers solutions for this. Of the hundreds of NEW GPO settings, cutting off Internet access (or portions thereof) is now available. (Note: you could do it before via restricting zone settings yada yada, but now there's a one-stop-shop block Internet settings GPO)
With some experimentation, you can cut off the IntErnet without cutting off the IntrAnet, per user or per computer (per OU actually) and still allow for WUS updating and other apps that need port:80 access or some other internet functions.
I can actually make it so the forklift driver can't get on the 'net on any machine, meanwhile the secretary can...on the same machine. Pretty nifty.
You should be able to do this with the local gpedit.msc too if you don't have an AD network.
The catch is..naturally, it doesn't work unless you have WinXP SP2 clients.

MS Content Advisor - No Access option

Microsoft has a rating you can use called noaccess.rat and is activated through the Tools/Internet Options/Content area. It will block all outside Internet access in IE, but allow only Intranet access. I have customized our Company's Browser and include this file along with a couple other rating files that I can turn on and off whenever the need arises. If I turn on the No Access, I usually will also uncheck the box for allowing users to see site with no ratings under the General Tab just to be safe.

I guess this would be outdated, but... Based on the replies you've gotten thus far, this is a much less sophisticated option, but for our small customers who wish to have some clients off the net our solution is twofold:
1. As mentioned before, remove all indications of Internet Explorer from the computer - go to the Control Panel and in Add/Remove choose the "Add/Remove Windows Components" option on the left pane and deselect Internet Explorer. (By the way, nosy users will still be able to browse the Internet by typing the URL in the Windows Explorer address bar, that's why there's step two)
2. Find on the web (or I can send a copy to you) "Noaccess.rat". This is an Internet Explorer ratings file that you can load in your "%SystemRoot%\System32" folder, then enable in the Internet Options section of Internet Explorer [TOOLS>>INTERNET OPTIONS] on the menu bar. Choose the "Content" tab at the top and select "Enable". There you will see the default rating scheme and the "Noaccess" scheme. If you are absolutely sure you want to do this, then remove the default scheme (the other .rat file in %SystemRoot%\System32) and configure your noaccess.
Problem is this only works for IE, and I said, if a user is a little too smart for his/her britches then they'll probably just download firefox or load it from a CD.
The second part of the solution (I don't really care for the first one, it's to easy for a user to figure out) given by Zaferus is really the most ideal "set the Internet router to deny all port 80 traffic to the WAN from the IP address of the client PC you want to block."

interesting conundrum
That sort of carefully controlled environment is difficult to achieve with a Windows network. You could probably do it by segmenting the network and controlling traffic between network segments with a tiered Windows update deployment setup, so that individual machines aren't getting direct access to the Internet, and with a proxy server that grants access to some user accounts but not others (I think it'd have to be a non-Windows proxy server, like Squid on Linux, to work properly, though I'm not sure about that).
If you were running Linux systems, it would be much, much easier, since Linux (like any Unix) is an inherently multi-user system. All you would have to do is create user accounts with specifically tailored application access for the users that you don't want doing anything except what is directly required for their jobs. This sort of thing is sorta possible in a Windows network, but it tends to require jumping through a lot of hoops, tying OS configuration into knots, and a lot of server-side monkeying around.

Restaurar sistema desactivado

"Restaurar sistema ha sido desactivado por una directiva de grupo"
Solución
INICIO >>Ejecutar
gpedit.msc (Directiva de grupo)
CONFIGURACIÓN DE EQUIPO-CONFIGURACIÓN DE WINDOWS
-CONFIGURACIÓN DE SEGURIDAD-DIRECTIVAS LOCALES
-OPCIONES DE SEGURIDAD-CONSOLA DE RECUPERACIÓN
-Permitir el inicio de sesión administrativo automático
(HABILITAR)