Do you know gpedit.msc? It's Microsoft Management Console (MMC) application used to configure the policies on a domain or on a computer. Policies, all the little authorizations, hidden most of the times. Some of them are revealed through Tweak UI: show/hide Netwok Neighbourhood, show/hide Control Panel and so on. Others are less exposed, like to forbid the use of tools known to act upon the registry for instance. Since you have two levels of settings (machine and current user), you would think it's a good tool to restrict a user account on a single Windows 2000 machine:

  1. make the user an administrator
  2. logon with this user
  3. restrict his/her rights with gpedit
  4. logoff
  5. logon with your administrator account
  6. remove the user from the administrators group

Right? No, it would be so simple and useful if it could work like this, remember, it's Microsoft. So when you modify the user settings, by a secret scheme (Redmond©), it modifies randomly the other users accounts. With the method exposed above, all you've got is a complete mess.