locked
Double click on PROGRAMS RRS feed

  • Question

  • When I'm logged on as a locked down user, I double click on 'Programs' and it opens up explorer and from there I can navigate through the whole pc, execute programs, add and remove folders even if I've selected that the User can't delete or change files etc on the HDD. Any ideas where I've gone wrong in the setup?

    (WinXP SP2)

     

    Friday, August 29, 2008 1:28 PM

Answers

  •  

    Thank you for the update. Sparkie, based on the current situation, let's add permission to the program folder and see if this works in the scenario.

     

    1.       Let's log on the account that you want to restrict.

    2.       Double click on Programs. By default, it will open C:\Documents and Settings\Username\Start Menu\Programs

    3.       Log off and use administrator to log on. Open the folder, C:\Documents and Settings\test.VPC-XP\Start Menu\, locate Programs folder, right click on it and choose properties, security.

    4.       Deny the certain user to access the folder.

     

    Let's see if this one works.

    Thursday, September 4, 2008 6:45 AM

All replies

  •  

    For such scenario, I suggest you turn on Windows Disk Protection and set "Remove all changes at restart". In this way, those changes will discard after the user log off and restart the computer.

    Monday, September 1, 2008 6:55 AM
  • This will not work for us as we're capturing data onto the hard drive. Also, the users will still be able to navigate around the pc and execute programs even if they're locked in Steady Sate!!! BIG PROBLEM!!

    Monday, September 1, 2008 8:28 AM
  •  

    Hi Sparkie, if you need to capture data onto the computer, can you use removable device instead and those data can still be retained after enabling Windows Disk Protection? We can try "block program" setting to block certain user to run a program. We can also change user type to limit user so that they are not able to add/remove programs. By the way, if we turn on Windows Disk Protection, we do not need to worry about those who delete files/folders on system partition. These files/folders will be reset to original state after the user logging off or restarting the computer.

     

    Please let me know if this can be a workaround for the current scenario.

    Wednesday, September 3, 2008 5:37 AM
  • Hi Sean,

    Thank you for your reply – please see my reply below:

    We can’t store data on a USB stick:- This is in a factory environment and the all pc ports are sealed to keep out dust etc.

    We can’t enable Windows disk protection:- Data from the all locked down pc's is stored on a central pc for to all to access.

    Setting "block program":- In order for this to work we’ll need to add every exe on the hard drive, even the programs not listed on Steady State (e.g. solitaire). This is not ideal – for example, the users are not permitted to browse the internet, but the program must have internet access. We have removed the icons so they can’t see and therefore can’t use Internet Explorer, but the program still runs correctly.  So if the user double clicks on ‘All Programs’, he can navigate around Steady State and open IE.

    We have enabled the setting so users are not able to add/remove programs.

     

    Again – disk protection is not an option in our scenario.

     

    What will work for me is to either remove ‘All Programs’ from the menu (preferably without altering the registry settings as we will void the warrantee on the pc’s) or disabling double clicking for the locked user.

    Wednesday, September 3, 2008 7:02 AM
  •  

    Thank you for the update. Sparkie, based on the current situation, let's add permission to the program folder and see if this works in the scenario.

     

    1.       Let's log on the account that you want to restrict.

    2.       Double click on Programs. By default, it will open C:\Documents and Settings\Username\Start Menu\Programs

    3.       Log off and use administrator to log on. Open the folder, C:\Documents and Settings\test.VPC-XP\Start Menu\, locate Programs folder, right click on it and choose properties, security.

    4.       Deny the certain user to access the folder.

     

    Let's see if this one works.

    Thursday, September 4, 2008 6:45 AM
  • Hi Sean,

    This looks like it will work! I've tried this in the test environment and so far so good. I was concerned that the program in the startup folder wouldn’t open but it does.

     

    Thursday, September 4, 2008 9:02 AM