Re: disable local security policy
OK there are several things you can do – you decide which one you feel happiest with.
1. You can make him a User, not an Administrator. He may have trouble running some programs, however, so this may not help you in the long run.
2. If the Windows installation is on an NTFS partition, you can alter the permissions to mmc.exe (which is in C:WindowsSystem32) so that only you can run that program. Without it, he will have trouble running anything to do with local security policy, even if he tries to launch it from the Control Panel.
3. You can let him deny you access to your name in the local security policy and then you simply connect to his computer under his name and password, or under the Administrator’s name and password instead.
4. You can be nice to him and ask him why he is doing this and sort it out diplomatically. Ask him why he wishes to deny you access to his computer and if he has a good reason, maybe you have to respect his wishes :( especially if it is his computer!