User group & rights in XP

[RejectKnowledge]

Okay, here is my agenda. More often than not my PC has been compromised by trojans, and virus and various other things that have been downloaded by the clueless users of my PC. I've tried to restrict their access to a being a normal User in XP, but that bars them from running any .exe's including Messenger ( as an example ). Now, heres the deal...


On my XP Professional box, I have two accounts. 'Bubz ' ( belonging to Administrator )and 'people ' ( belonging to the 'Users ' group as specified by the XP GUI in the Control Panel ). I've been having issues with getting the 'people 's account to run Windows Messenger. The only time I manage to run it whilst logged on as people is if I right click, and chose Run As > Administrator or as Bubz . But then, that kinda negates the point of me making a people's account for everyone else to use the PC, right? I've tried a few things that haven't worked, and I'll try to explain them as best I can.

1. I did the whole 'Right Click on the file and go to Security' part, change the access permisions to allow Users group to execute the file MSMSGS.EXE. Logging into 'people ' gave me absolutely nothing. Couldn't access the file.

2. Back as Bubz , I thought that maybe the inheritance was a problem ( since Users probably couldn't access the directory itself. It's the Program files direcrtory on the root drive, but I'm sure y'all already knew that ). Disabling the inheritance, I set up the permissions again, giving both Users and Administrators ( the groups ) the permissions. The Bubz account opened the file easily, but again people couldn't. Back to square one.

3. An interesting thing I noted was that on a previous experimental account 'test ' ( Admin ), I downgraded the account to User , and this account was able to use Messenger. I don't know if this was a freak accident, or had something to do with some setting I messed up. Ofcourse, test was able to access everything, just like the Admin group.

Now, my question is this. I want to create a user , that does not have permission to execute ANY .exe .com or .bat ( basically the 'dangerous' extensions ) on the PC. They should be allowed to execute files that the Administrators have specified permissions for ONLY, like MSN, or ICQ, or even mIRC. Because the stuff my users download is a real headache and they've managed to mess up my PC a few times ( users - read as clueless family members & kids ). Thank God for firewalls and Anti-viruses, otherwise my PC would've become a playground.

This is what I need help with. It would be great if someone could explain if and how this is possible. Will I have to set up a new group , with a new group policy? Or is the current 'User' group customizeable enough to do so? Should I even bother doing this? Help me out guys.

Another question is that how can I manage to display an account in a custom group besides the ones in the default groups on the XP Welcome Screen?

Whew. There we go.
Cheers.

[RejectKnowledge]

heh wow. So many replies!