Solved

securing certain  programs

Posted on 2004-09-23
6
179 Views
Last Modified: 2013-12-04
At church, we have a computer in the saunctuary running Win XP that we use for presentations during services.  Up until now, we have all used the same login account, but now we need to create a guest account for about 6 weeks for some other users that are doing a special project during the week.  They will be unmonitored and limited on their computer skills, so I have some issues that I need to address.

I created a "limited" account, gave it a password... so far so good!  They cannot get in to our "main" account "My Documents" folder which is good.

Here's my question: is there a way to lock them out of certain programs, like Internet Explorer for sure.

Here's the scenario...  they need to use PowerPoint and Photo Impact 7 only.  We do not want them using the internet or messing around in the other programs, or worst yet, getting into some system file or erasing files.

Any help would be great,

Thanks, Jimmy
0
Comment
Question by:sisterpete
6 Comments
 
LVL 65

Accepted Solution

by:
SheharyaarSaahil earned 84 total points
Comment Utility
Hello sisterpete =)

Check these links, might can help u :)

HOW TO: Restrict Users from Running Specific Windows Programs in Windows 2000(same for XP)
http://support.microsoft.com/?kbid=323525

Restrict Users from Running Specific Applications
http://www.winguides.com/registry/display.php/969/

!! GOOD LUCK !!
0
 
LVL 24

Assisted Solution

by:SunBow
SunBow earned 83 total points
Comment Utility
> a way to lock them out of certain programs, like Internet Explorer for sure.

No.  However, it is not difficult, and even easier than upgrades:  Pull the plug. While they are using it, unplug it from wall, perhaps even taking the HW with you.  Given church scenario, it begs question of of why the mistrust? Why not simply tell them what they can and cannot do, and trust them to comply?  OK, maybe some are teenies, that have some cofusions and new hormones to deal with.  So, answer goes back to simply pulling the plug, the internet connection. If they can't do IE, they don't need the net.  If they need to help email, do that offline.  Don't try to hide IE under any gimmick, that is a losing battle.

> messing around in the other programs, or worst yet, getting into some system file or erasing files.

So IE is least of your worries. I know you'll face tight budget, but there's a time and a place, and this is the time.  The thing you must do is go buy another hard drive, compatible to system. You can justify by eventually needing it yourself, and as a contigency for failure of current one. Fortunately, their size keeps increasing while price drops, so this should be doable.  Now, take the existing HD out of PC, go squirrel it away somewhere, hide in closet or take home. Once the new drive is in system, let them use it, abuse it to their hearts content.  They can learn on their own from sites like this how to get at your files, but no website can tell them how to find this disk that the files are on, so do not leave it in plain site and you can win that battle.

You'll learn later that you have another problem to face, and that is, how to remove all the junk (er, I mean 'toys'? freebies?) that got loaded when not looking. Who knows what was loaded or how, through cd, nic, fd, modem ... whatever, you cannot prevent that, rule goes that possession is 9/10ths of the law, and that applies here.  

Easy answer is to not try to identify what to remove. Just remove it all!  You may find some desireable files to make copies of first. But for those you already know what they are and won't have to guess.  Do copy them off, format the HD, and all the junk is definitely gone.  You can then copy the desireable files back to the HD if you want, and have the confidence that other than those files, the disk is cleaned of any potential malware or whatever.

Do: forget any gimmicks, or tricks, no matter the source, for once anyone but you has physical possession, all security levels have been breeched, all bets off for protecting anything. Whether they know now how to act is not the question, anyone can learn, experiment, play.

Old alternative is, put all your HD content on CD.  Each new day, rebuild/reload HD from CD.  This keeps integrity, resetting to what it was.  Good idea for plainn classroom to restore.  Bad idea if something was added to HD that you want to save.  Since you seem to want to save and preserve at least some changes, skip the CD method. Besides, it still leaves one open to prying eyes for whatever is remaining on HD.

Answer: Get another HD for them to use
0
 
LVL 2

Assisted Solution

by:ibradshaw
ibradshaw earned 83 total points
Comment Utility
One idea...

If there not teckkies then this will help a bit...

Change there account from Limited to Guest (via control pannel -> Admin Tools -> local users. You may need to disable simple file sharing to do this as well (Windows Explorer -> Folder Options -> View -> Scroll to bottom of list).

Then go through your program files folder (c:\Program Files) and change the file permssions so that only administrators have access to them. (right click the folder -> properties -> security).

Provided you give your main account admin rights (which I presume it has) this will work. Logon to the account you created for them and then try it. You should get a permissions error if you try and run anything from there account.

This won't stop them installing something, but will stop them messing with whats already there.

Also, you could do this by chaning the 'users' group so that it doesn't have 'read & execute' access. The new user will be running under this set of permissions, so it should work.

Also (!), check the advanced tab and go to 'replace permissions on all child objects' is checked after you have set it up and then this will replace permissions on all sub directores. (do the above on the programs folder itself).

Then, go to the individual programs you want them to have access to and change the permissions for just those folders.

Cheers,

Ian.


....probably not the best description in the world of what to do...   if you get stuck, then post again and I'll try harder!
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now