Hi everyone,

I posted these questions on several Microsoft groups but received no useful replies. Someone on Minasi.com pointed me here. I know most GP question apply to an AD environment but mine apply to a local machine (I hope you don't mind).

I have an XP Pro SP2 machine that will be shared by several family members and I have a few questions about *Local* Group Policies. Windows Server and Active Directory are not involved here.

In the Group Policy Editor (gpedit.msc) I want to turn off IE's prompt to download ActiveX Controls (as well as several other features). The setting for this is at:

User Configuration
--> Administrative Templates
-----> Windows Components
-------> Internet Explorer
---------> Security Features
-----------> Restrict ActiveX Install
-------------> Internet Explorer Process = Enabled

After setting this policy I log off and then log back on but IE still prompts me to download ActiveX controls (Acrobat Reader, for example). It seems the GP setting is not taking effect. Does anyone know why the changes do not work? I also tried "gpupdate /force" after changing the policy but that had no effect either.

A follow up question is this: My understanding is that, contrary to the name, "User Configuration" policies apply to *all* users, not individual users. So, setting the "User Configuration" policies affects *all* accounts on the machine. If this is true, why does the Group Policy editor have separate sections for "User Configuration" and "System Configuration"?

Perhaps it *is* possible to specify separate policies for different accounts. This is ultimately what I want to do -- different family members should have different rights. I have an idea on how to do this (by copying .pol files and invoking gpupdate.exe) but the fact that ActiveX installations cannot be turned off is stopping me dead in my tracks.

Thanks much.