Re: Local policy, IE and SP2...
From: YaronM (nospam)
Date: 02/21/05
- Next message: chris_at_netcontrol: "Re: DOK USB Boot -> 7B Error"
- Previous message: KM: "Re: Asus V9250 magic graphics driver - can't see adaptor in Contro"
- In reply to: KM: "Re: Local policy, IE and SP2..."
- Next in thread: Slobodan Brcin \(eMVP\): "Re: Local policy, IE and SP2..."
- Reply: Slobodan Brcin \(eMVP\): "Re: Local policy, IE and SP2..."
- Reply: KM: "Re: Local policy, IE and SP2..."
- Messages sorted by: [ date ] [ thread ]
Date: Tue, 22 Feb 2005 00:28:26 +0200
Hi KM,
The procedure I'm using includes a small utility I created that configures
the type of shell for each user profile.
The "shell-configurator" allows you to choose between the MS-Explorer and
our custom-shell. after you choose, it loads the ntuser.dat hive from the
user's profile folder to the
registry (to a "saltemp" hive under hkey_users). then I do a "reg import"
command to import the policy.reg (attached as a txt file).
the policies are intended to make the user use the IE for internet browsing
only and to be able to run specific shortcuts on the user's desktop.
besides the policies, the user's shell is also configured in the windows
nt\winlogon key as described in the MS-article of "different shell for each
user...".
the hive is then unloaded and the user can log-in using his chosen shell.
needless to say that I commit the changes in the EWF before restarting.
I used this procedure perfectly under SP1 with no changes. I now run it
under SP2 and all of the policies are active besides the NoViewOnDrive that
still enables access to drive C.
oddly, I do get an Access denied on drive Z..
I also seen it works on XPPro-SP2 and that's what keeps me searching for
clues..
I will try to find some other solutions and maybe include some NTFS
permissions too. I will also check the option of using the stronger sister
of DisallowRun- the "Only run these specific..." and maybe this will help me
out.
I still think MS makes our life much more difficult because of the IE
integration so deep in the OS environment. things could have been much
easier if I could get a decent browser-only application (and I'm not
reffering to the opensource-alternative "F" word :))).
Thanks for your help.
YaronM
"KM" <konstmor@nospam_yahoo.com> wrote in message
news:O2gKfLFGFHA.1348@TK2MSFTNGP14.phx.gbl...
> YaronM,
>
> I must mention here that I rarely use GPEdit and almost always I change
> the Explorer or System policies through registry.
> The same I did for those tests I mentioned for SP2. As I said earlier, the
> NoViewOnDrive worked just fine for me.
> Could you write for us the steps you did exactly (including logoff's and
> reboot's)?
>
> However, this is true - those policies will not allow you to lock user
> accounts from launching applications from hidden drives.
> That is where the DisallowRun can help you. I checked - it worked fine for
> me on XP Pro SP2. Therefore it will work on XPe SP2 too.
>
> Although I must admit, locking some applications through NTFS permissions
> may be a better idea.
>
> If you really want to lock down the OS you may want to take a look at some
> 3rd party solutions. E.g., Sygate agent will allow you to
> lock down user account(s) to allow the launch of only particular
> applications. There is an XPe version of Sygate client available.
>
> --
> Regards,
> KM, BSquare Corp.
>
>
>> Hi,
>>
>> I am using different shells for each user. I use the Explorer.exe for the
>> administrator and my custom shell for the user.
>> I have two problems:
>> 1. the policy NoViewOnDrive only works if I use it through gpedit.msc and
>> not if I set it manually in the user's hive (NTuser.dat in his profile).
>> by locking through gpedit.msc I am limited because it can affect the
>> admin account also and I need to use workarounds such as NTFS deny on the
>> GroupPolicy folder or the
>> registry.pol and it is very inconvenient to administer and maintain.
>> in SP1 the manual setting in the user's registry hive worked fine and
>> now in SP2, Windows is ignoring the registry settings and just let the
>> user
>> access the drive's content.
>> 2. even when using the above policy, the user can still write a full path
>> to
>> a file in the IE address-bar and launch it. for example,
>> C:\WINDOWS\NOTEPAD.EXE. only if I prevented running the specific file or
>> locked it using NTFS CALS then the file will be locked. but this means
>> changing all the system's default permissions on all files and I can't
>> even
>> imagine what problems could come from such an approach.
>>
>> I basically need to turn IE into an "Internet Browser Only Mode" without
>> any
>> local access to files and folders (if such a thing even exist...).
>>
>> Thanks,
>>
>> YaronM
>>
>>
>>
>> "KM" <konstmor@nospam_yahoo.com> wrote in message
>> news:uqlIFx%23FFHA.1456@TK2MSFTNGP09.phx.gbl...
>> > YaronM,
>> >
>> > I haven't tried the DisallowRun policy on SP2 but NoViewOnDrive and
>> > NoDrives worked for me just fine.
>> >
>> > As you know the NoDrives key would only "hide" the specified drives in
>> > My
>> > Computer folder (user can still type a hidden drive name or a folder on
>> > that drive and can navigate there). However, if the NoViewOnDrive would
>> > disallow the user to go into any folder of the restricted drive and on
>> > typing in the Explorer address bar user would see an error message
>> > saying
>> > something about the policies set up.
>> >
>> > That worked for me on XP Pro SP2 and XPe SP2.
>> >
>> > KM
>> >
>> >> Hi,
>> >>
>> >> I've been working with local security policies since SP1 and used many
>> >> registry tweaks to lock-down the user's desktop.
>> >> now, after I upgraded my builds to SP2 level, I'm getting some strange
>> >> behaviour from Windows.
>> >>
>> >> My purpose is to lock the user's access to the local drive (i.e. C:
>> >> Flash
>> >> and Z: Ram-disk). that way, the user can only browse the internet
>> >> using
>> >> IE and launching application using my custom-shell.
>> >> I've used the following reg-policies on the HKCU to prevent access for
>> >> the user only (not the admin account):
>> >>
>> >> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
>> >> "DisallowRun"=dword:00000001
>> >> "NoViewOnDrive"=dword:67108863
>> >> "NoDrives"=dword:67108863
>> >>
>> >> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun]
>> >> "1"="ewfmgr.exe"
>> >> "2"="mmc.exe"
>> >> "3"="musrmgr.exe"
>> >> "4"="tweakui.exe"
>> >> "5"="explorer.exe"
>> >>
>> >>
>> >> the number 67108863 represent "all drives". the problem is that on
>> >> SP1,
>> >> when a user launched IE and on the address-bar entered C:\ or some
>> >> sort
>> >> of a local path- it gave him "access denied" errors. now, in SP2 if I
>> >> type C:\ it doesn't allow but if I launch c:\windows it does... :((
>> >> (P.S. I tried setting the number that represnt C+Z only.. same
>> >> behaviour).
>> >>
>> >> maybe I am looking in the wrong direction.. is there a way to turn IE
>> >> to
>> >> be an Internet-Browser only, without having this irritating synergy
>> >> with
>> >> the Explorer shell ?
>> >>
>> >> just a thought: maybe I could rename explorer.exe to MSshell.exe and
>> >> set
>> >> it to be the admin's defeault shell, that way in the user's session
>> >> the
>> >> IE will not find it...
>> >>
>> >> anyways, if anyone could share it's expirience I will be most thankful
>> >> !
>> >>
>> >> Cheers,
>> >>
>> >> YaronM
>> >>
>> >
>> >
>>
>>
>
>
begin 666 Policy.txt
M__Y7`&D`;@!D`&\`=P!S`" `4@!E`&<`:0!S`'0`<@!Y`" `10!D`&D`= !O
M`'(`( !6`&4`<@!S`&D`;P!N`" `-0`N`# `, `-``H`#0`*``T`"@!;`$@`
M2P!%`%D`7P!5`%,`10!2`%,`7 !S`&$`; !T`&4`;0!P`%P`4P!O`&8`= !W
M`&$`<@!E`%P`30!I`&,`<@!O`',`;P!F`'0`7 !7`&D`;@!D`&\`=P!S`%P`
M0P!U`'(`<@!E`&X`= !6`&4`<@!S`&D`;P!N`%P`4 !O`&P`:0!C`&D`90!S
M`%T`#0`*``T`"@!;`$@`2P!%`%D`7P!5`%,`10!2`%,`7 !S`&$`; !T`&4`
M;0!P`%P`4P!O`&8`= !W`&$`<@!E`%P`30!I`&,`<@!O`',`;P!F`'0`7 !7
M`&D`;@!D`&\`=P!S`%P`0P!U`'(`<@!E`&X`= !6`&4`<@!S`&D`;P!N`%P`
M4 !O`&P`:0!C`&D`90!S`%P`00!C`'0`:0!V`&4`1 !E`',`:P!T`&\`< !=
M``T`"@`B`$X`;P!#`&@`80!N`&<`:0!N`&<`5P!A`&P`; !0`&$`< !E`'(`
M(@`]`&0`=P!O`'(`9 `Z`# `, `P`# `, `P`# `,0`-``H`#0`*`%L`2 !+
M`$4`60!?`%4`4P!%`%(`4P!<`',`80!L`'0`90!M`' `7 !3`&\`9@!T`'<`
M80!R`&4`7 !-`&D`8P!R`&\`<P!O`&8`= !<`%<`:0!N`&0`;P!W`',`7 !#
M`'4`<@!R`&4`;@!T`%8`90!R`',`:0!O`&X`7 !0`&\`; !I`&,`:0!E`',`
M7 !%`'@`< !L`&\`<@!E`'(`70`-``H`(@!.`&\`1 !R`&D`=@!E`%0`>0!P
M`&4`00!U`'0`;P!2`'4`;@`B`#T`9 !W`&\`<@!D`#H`, `P`# `, `P`# `
M.0`Q``T`"@`B`$X`;P!7`&D`;@!+`&4`>0!S`"(`/0!D`'<`;P!R`&0`.@`P
M`# `, `P`# `, `P`#$`#0`*`"(`3@!O`%(`90!C`'D`8P!L`&4`1@!I`&P`
M90!S`"(`/0!D`'<`;P!R`&0`.@`P`# `, `P`# `, `P`#$`#0`*`"(`3@!O
M`%0`: !U`&T`8@!N`&$`:0!L`$,`80!C`&@`90`B`#T`9 !W`&\`<@!D`#H`
M, `P`# `, `P`# `, `Q``T`"@`B`$X`;P!3`&4`= !4`&$`<P!K`&(`80!R
M`"(`/0!D`'<`;P!R`&0`.@`P`# `, `P`# `, `P`#$`#0`*`"(`20!N`'0`
M90!L`&P`:0!M`&4`;@!U`',`(@`]`&0`=P!O`'(`9 `Z`# `, `P`# `, `P
M`# `,0`-``H`(@!.`&\`20!N`',`= !R`'4`;0!E`&X`= !A`'0`:0!O`&X`
M(@`]`&0`=P!O`'(`9 `Z`# `, `P`# `, `P`# `,0`-``H`(@!.`&\`4P!I
M`&T`< !L`&4`4P!T`&$`<@!T`$T`90!N`'4`(@`]`&0`=P!O`'(`9 `Z`# `
M, `P`# `, `P`# `,0`-``H`(@!&`&\`<@!C`&4`00!C`'0`:0!V`&4`1 !E
M`',`:P!T`&\`< !/`&X`(@`]`&0`=P!O`'(`9 `Z`# `, `P`# `, `P`# `
M,0`-``H`(@!.`&\`00!C`'0`:0!V`&4`1 !E`',`:P!T`&\`< !#`&@`80!N
M`&<`90!S`"(`/0!D`'<`;P!R`&0`.@`P`# `, `P`# `, `P`#$`#0`*`"(`
M3@!O`$,`; !O`',`90!$`'(`80!G`$0`<@!O`' `0@!A`&X`9 !S`"(`/0!D
M`'<`;P!R`&0`.@`P`# `, `P`# `, `P`#$`#0`*`"(`3@!O`$T`;P!V`&D`
M;@!G`$(`80!N`&0`<P`B`#T`9 !W`&\`<@!D`#H`, `P`# `, `P`# `, `Q
M``T`"@`B`$X`;P!3`&$`=@!E`%,`90!T`'0`:0!N`&<`<P`B`#T`9 !W`&\`
M<@!D`#H`, `P`# `, `P`# `, `Q``T`"@`B`$X`;P!$`&4`<P!K`'0`;P!P
M`$,`; !E`&$`;@!U`' `5P!I`'H`80!R`&0`(@`]`&0`=P!O`'(`9 `Z`# `
M, `P`# `, `P`# `,0`-``H`(@!$`&D`<P!A`&P`; !O`'<`4@!U`&X`(@`]
M`&0`=P!O`'(`9 `Z`# `, `P`# `, `P`# `,0`-``H`(@!.`&\`00!U`'0`
M;P!5`' `9 !A`'0`90`B`#T`9 !W`&\`<@!D`#H`, `P`# `, `P`# `, `P
M``T`"@`B`$X`;P!7`&D`;@!D`&\`=P!S`%4`< !D`&$`= !E`"(`/0!D`'<`
M;P!R`&0`.@`P`# `, `P`# `, `P`#$`#0`*`"(`3@!O`%,`90!C`'4`<@!I
M`'0`>0!4`&$`8@`B`#T`9 !W`&\`<@!D`#H`, `P`# `, `P`# `, `Q``T`
M"@`B`$X`;P!6`&D`90!W`$\`;@!$`'(`:0!V`&4`(@`]`&0`=P!O`'(`9 `Z
M`#8`-P`Q`# `. `X`#8`,P`-``H`(@!.`&\`5@!I`&4`=P!#`&\`;@!T`&4`
M> !T`$T`90!N`'4`(@`]`&0`=P!O`'(`9 `Z`# `, `P`# `, `P`# `,0`-
M``H`(@!.`&\`3 !O`&<`3P!F`&8`(@`]`&0`=P!O`'(`9 `Z`# `, `P`# `
M, `P`# `,0`-``H`#0`*`%L`2 !+`$4`60!?`%4`4P!%`%(`4P!<`',`80!L
M`'0`90!M`' `7 !3`&\`9@!T`'<`80!R`&4`7 !-`&D`8P!R`&\`<P!O`&8`
M= !<`%<`:0!N`&0`;P!W`',`7 !#`'4`<@!R`&4`;@!T`%8`90!R`',`:0!O
M`&X`7 !0`&\`; !I`&,`:0!E`',`7 !%`'@`< !L`&\`<@!E`'(`7 !$`&D`
M<P!A`&P`; !O`'<`4@!U`&X`70`-``H`(@`Q`"(`/0`B`&4`=P!F`&T`9P!R
M`"X`90!X`&4`(@`-``H`(@`R`"(`/0`B`&T`;0!C`"X`90!X`&4`(@`-``H`
M(@`S`"(`/0`B`&T`=0!S`'(`;0!G`'(`+@!E`'@`90`B``T`"@`B`#0`(@`]
M`"(`= !W`&4`80!K`'4`:0`N`&4`> !E`"(`#0`*`"(`-0`B`#T`(@!E`'@`
M< !L`&\`<@!E`'(`+@!E`'@`90`B``T`"@`-``H`6P!(`$L`10!9`%\`50!3
M`$4`4@!3`%P`<P!A`&P`= !E`&T`< !<`%,`;P!F`'0`=P!A`'(`90!<`$T`
M:0!C`'(`;P!S`&\`9@!T`%P`5P!I`&X`9 !O`'<`<P!<`$,`=0!R`'(`90!N
M`'0`5@!E`'(`<P!I`&\`;@!<`% `;P!L`&D`8P!I`&4`<P!<`%,`>0!S`'0`
M90!M`%T`#0`*`"(`5P!A`&P`; !P`&$`< !E`'(`(@`]`"(`8P`Z`%P`7 !W
M`&D`;@!D`&\`=P!S`%P`7 !W`&4`8@!<`%P`=P!A`&P`; !P`&$`< !E`'(`
M7 !<`%,`80!L`$0`90!S`&L`+@!B`&T`< `B``T`"@`B`%<`80!L`&P`< !A
M`' `90!R`%,`= !Y`&P`90`B`#T`(@`R`"(`#0`*`"(`3@!O`$0`:0!S`' `
M0@!A`&,`:P!G`'(`;P!U`&X`9 !0`&$`9P!E`"(`/0!D`'<`;P!R`&0`.@`P
M`# `, `P`# `, `P`#$`#0`*`"(`1 !I`',`80!B`&P`90!2`&4`9P!I`',`
M= !R`'D`5 !O`&\`; !S`"(`/0!D`'<`;P!R`&0`.@`P`# `, `P`# `, `P
M`#$`#0`*`"(`1 !I`',`80!B`&P`90!,`&\`8P!K`%<`;P!R`&L`<P!T`&$`
M= !I`&\`;@`B`#T`9 !W`&\`<@!D`#H`, `P`# `, `P`# `, `Q``T`"@`B
M`$0`:0!S`&$`8@!L`&4`0P!H`&$`;@!G`&4`4 !A`',`<P!W`&\`<@!D`"(`
M/0!D`'<`;P!R`&0`.@`P`# `, `P`# `, `P`#$`#0`*`"(`1 !I`',`80!B
M`&P`90!4`&$`<P!K`$T`9P!R`"(`/0!D`'<`;P!R`&0`.@`P`# `, `P`# `
M, `P`#$`#0`*`"(`1 !I`',`80!B`&P`90!#`$T`1 `B`#T`9 !W`&\`<@!D
M`#H`, `P`# `, `P`# `, `R``T`"@`-``H`6P!(`$L`10!9`%\`50!3`$4`
M4@!3`%P`<P!A`&P`= !E`&T`< !<`%,`;P!F`'0`=P!A`'(`90!<`$T`:0!C
M`'(`;P!S`&\`9@!T`%P`5P!I`&X`9 !O`'<`<P!<`$,`=0!R`'(`90!N`'0`
M5@!E`'(`<P!I`&\`;@!<`% `;P!L`&D`8P!I`&4`<P!<`%<`:0!N`&0`;P!W
M`',`50!P`&0`80!T`&4`70`-``H`(@!$`&D`<P!A`&(`; !E`%<`:0!N`&0`
M;P!W`',`50!P`&0`80!T`&4`00!C`&,`90!S`',`(@`]`&0`=P!O`'(`9 `Z
M`# `, `P`# `, `P`# `,0`-``H`#0`*`%L`2 !+`$4`60!?`%4`4P!%`%(`
M4P!<`',`80!L`'0`90!M`' `7 !3`&\`9@!T`'<`80!R`&4`7 !-`&D`8P!R
M`&\`<P!O`&8`= !<`$D`;@!T`&4`<@!N`&4`= `@`$4`> !P`&P`;P!R`&4`
M<@!<`$T`80!I`&X`70`-``H`(@!.`&\`50!P`&0`80!T`&4`0P!H`&4`8P!K
M`"(`/0!D`'<`;P!R`&0`.@`P`# `, `P`# `, `P`#$`#0`*`"(`1 !I`',`
M80!B`&P`90`@`%,`8P!R`&D`< !T`" `1 !E`&(`=0!G`&<`90!R`"(`/0`B
M`'D`90!S`"(`#0`*`"(`1 !I`',`80!B`&P`90!3`&,`<@!I`' `= !$`&4`
M8@!U`&<`9P!E`'(`20!%`"(`/0`B`'D`90!S`"(`#0`*``T`"@!;`$@`2P!%
M`%D`7P!5`%,`10!2`%,`7 !S`&$`; !T`&4`;0!P`%P`4P!O`&8`= !W`&$`
M<@!E`%P`4 !O`&P`:0!C`&D`90!S`%P`30!I`&,`<@!O`',`;P!F`'0`7 !)
M`&X`= !E`'(`;@!E`'0`( !%`'@`< !L`&\`<@!E`'(`7 !2`&4`<P!T`'(`
M:0!C`'0`:0!O`&X`<P!=``T`"@`B`$X`;P!&`&D`; !E`$\`< !E`&X`(@`]
M`&0`=P!O`'(`9 `Z`# `, `P`# `, `P`# `,0`-``H`(@!.`&\`1@!A`'8`
M;P!R`&D`= !E`',`(@`]`&0`=P!O`'(`9 `Z`# `, `P`# `, `P`# `,0`-
M``H`(@!.`&\`0@!R`&\`=P!S`&4`<@!#`&\`;@!T`&4`> !T`$T`90!N`'4`
M(@`]`&0`=P!O`'(`9 `Z`# `, `P`# `, `P`# `,0`-``H`(@!.`&\`0@!R
M`&\`=P!S`&4`<@!"`&$`<@!S`"(`/0!D`'<`;P!R`&0`.@`P`# `, `P`# `
M, `P`#$`#0`*``T`"@!;`$@`2P!%`%D`7P!5`%,`10!2`%,`7 !S`&$`; !T
M`&4`;0!P`%P`0P!O`&X`= !R`&\`; `@`% `80!N`&4`; !<`$0`90!S`&L`
M= !O`' `70`-``H`(@!7`&$`; !L`' `80!P`&4`<@`B`#T`(@!C`#H`7 !<
M`'<`:0!N`&0`;P!W`',`7 !<`'<`90!B`%P`7 !W`&$`; !L`' `80!P`&4`
M<@!<`%P`4P!A`&P`1 !E`',`:P`N`&(`;0!P`"(`#0`*`"(`5P!A`&P`; !P
A`&$`< !E`'(`4P!T`'D`; !E`"(`/0`B`#(`(@`-``H`
`
end
- Next message: chris_at_netcontrol: "Re: DOK USB Boot -> 7B Error"
- Previous message: KM: "Re: Asus V9250 magic graphics driver - can't see adaptor in Contro"
- In reply to: KM: "Re: Local policy, IE and SP2..."
- Next in thread: Slobodan Brcin \(eMVP\): "Re: Local policy, IE and SP2..."
- Reply: Slobodan Brcin \(eMVP\): "Re: Local policy, IE and SP2..."
- Reply: KM: "Re: Local policy, IE and SP2..."
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
