locked
Additional General Windows XP Restrictions - Remove CD and DVD burning features RRS feed

  • Question

  • Hello,
    I tried utility SteadyState and I thought that is solution for my problem.
    But, unfortunately it's not. Maybe you can help me.
    I have to restrict limited user account (precisely WMP11) to burn audio nor MP3 songs from HDD.
    SteadyState utility has command
    Remove CD and DVD burning features
    under Additional General Windows XP Restrictions
    but, it doesn't work well. User still can burn the CD or DVD.
    Normally, admin have to have all rights to burn CD or DVD.

    Tx
    Monday, September 17, 2007 11:58 AM

Answers

  • perhaps the easiest way is to diable the IMAPI CD-Burning COM Service and use windows ntfs securuty to prevent access to any additional cd burning software.  This has the effect of them being able to read CD's but not burn to them. There are additional security settings under the local security mmc.

    L

     

    "Nothing is fool proof. Because fools are so ingenius" Smile

     

    Tuesday, September 18, 2007 12:43 AM
  • Hi,

     

    Based on my further research, the “Remove CD and DVD burning features” option in SteadyState is applied through the following group policy:

     

    [Administrative Templates\Windows Components\Windows Explorer\Remove CD burning features]

     

    The following information can be found from the Explain tab of this policy:

     

    “Windows Explorer allows you to create and modify re-writable CDs if you have a CD writer connected to your PC. If you enable this setting, all features in the Windows Explorer that allow you to use your CD writer are removed. If you disable or do not configure this setting, users are able to use the Windows Explorer CD burning features.

     

    Note: This setting does not prevent users from using third-party applications to create or modify CDs using a CD writer.”

     

    Thus, this policy only prevent burning CDs from Windows Explorer. Other programs such as Media Player will not be affected.

     

     

    You can take lesterpenguinne’s suggestions to prevent users from burning CD or DVD. Here are some detailed steps:

     

    Disable IMAPI CD-Burning COM Service

    ------------------------

    1. Click Start and then Run. Type in services.msc and press Enter.

    2. Double click IMAPI CD-Burning COM Service to open it.

    3. Change its start type to Disable and then stop the service.

     

    Note: If administrator want to burn a CD, you need to start the service manually.

     

    By default, Windows XP doesn’t have DVD burning feature. If you have some DVD burning software such as Nero installed, we have to prevent user from accessing it. You can block it from SteadyState or creating a software restriction policy.

     

    To block a program from SteadyState

    ------------------------

    1. Start SteadyState and click the public user name.

    2. Click the “Block Programs” tab.

    3. Select the burning program from the program list. Click block.

    4. Click OK.

     

    You can also refer to the following thread to create a software restriction policy:

     

    http://forums.microsoft.com/WindowsToolsandUtilities/ShowPost.aspx?PostID=2123540&SiteID=69

     

     

    Note: When performing the above steps, if you have WDP enabled, please change it to “Retain all changes permanently” to save all the changes.

     

    Best Regards,

    Tuesday, September 18, 2007 6:37 AM
  • Thank you Shawn Shao,


    That is explain everything. It is not possible to restrict CD burning feature just in the WMP11.


    Pc is for my friend witch is not friendly with services and other commands, so it is not good solution for my problem.


    Blocking Nero and other programs are working fine with SteadyState.


    I'm thinking to block WMP with SteadyState and install third party player such is Win Amp LITE (without CD burning). But I'm wondering if will work fine under limited account. I'll let you know.


    Ciao


    Tuesday, September 18, 2007 7:27 AM

All replies

  • perhaps the easiest way is to diable the IMAPI CD-Burning COM Service and use windows ntfs securuty to prevent access to any additional cd burning software.  This has the effect of them being able to read CD's but not burn to them. There are additional security settings under the local security mmc.

    L

     

    "Nothing is fool proof. Because fools are so ingenius" Smile

     

    Tuesday, September 18, 2007 12:43 AM
  • Hi,

     

    Based on my further research, the “Remove CD and DVD burning features” option in SteadyState is applied through the following group policy:

     

    [Administrative Templates\Windows Components\Windows Explorer\Remove CD burning features]

     

    The following information can be found from the Explain tab of this policy:

     

    “Windows Explorer allows you to create and modify re-writable CDs if you have a CD writer connected to your PC. If you enable this setting, all features in the Windows Explorer that allow you to use your CD writer are removed. If you disable or do not configure this setting, users are able to use the Windows Explorer CD burning features.

     

    Note: This setting does not prevent users from using third-party applications to create or modify CDs using a CD writer.”

     

    Thus, this policy only prevent burning CDs from Windows Explorer. Other programs such as Media Player will not be affected.

     

     

    You can take lesterpenguinne’s suggestions to prevent users from burning CD or DVD. Here are some detailed steps:

     

    Disable IMAPI CD-Burning COM Service

    ------------------------

    1. Click Start and then Run. Type in services.msc and press Enter.

    2. Double click IMAPI CD-Burning COM Service to open it.

    3. Change its start type to Disable and then stop the service.

     

    Note: If administrator want to burn a CD, you need to start the service manually.

     

    By default, Windows XP doesn’t have DVD burning feature. If you have some DVD burning software such as Nero installed, we have to prevent user from accessing it. You can block it from SteadyState or creating a software restriction policy.

     

    To block a program from SteadyState

    ------------------------

    1. Start SteadyState and click the public user name.

    2. Click the “Block Programs” tab.

    3. Select the burning program from the program list. Click block.

    4. Click OK.

     

    You can also refer to the following thread to create a software restriction policy:

     

    http://forums.microsoft.com/WindowsToolsandUtilities/ShowPost.aspx?PostID=2123540&SiteID=69

     

     

    Note: When performing the above steps, if you have WDP enabled, please change it to “Retain all changes permanently” to save all the changes.

     

    Best Regards,

    Tuesday, September 18, 2007 6:37 AM
  • thanks for your reply.

    i can also disable CD burning feature from :
    gpedit.msc, then go to User Configuration\Administrative Templates\Windows Components\Windows Explorer\

    find 'Remove CD Burning Features" and enable it.

    but i have wondering why this restriction doesn't work with SteadyState.



    Tuesday, September 18, 2007 7:08 AM
  • Thank you Shawn Shao,


    That is explain everything. It is not possible to restrict CD burning feature just in the WMP11.


    Pc is for my friend witch is not friendly with services and other commands, so it is not good solution for my problem.


    Blocking Nero and other programs are working fine with SteadyState.


    I'm thinking to block WMP with SteadyState and install third party player such is Win Amp LITE (without CD burning). But I'm wondering if will work fine under limited account. I'll let you know.


    Ciao


    Tuesday, September 18, 2007 7:27 AM
  • Thank you for your feedback! If there is any update or further assistance is needed, please feel free to let me know.

    Wednesday, September 19, 2007 6:27 AM
  • So, hire I'm again.

    After hours trying to find proper solution which is working fine, I have discovered that only solution is to give to second user admin rights and to restrict everything with SteadyState or with secpol. Now I have user who is able ONLY to play music just with WinAmp (which it doesn't work without admin rights) and nothing else!
    If you have similar problems and solutions, just let me know.

    Thanks

    Tuesday, September 25, 2007 7:58 AM
  •  

    Thank you for your prompt update on this issue. If there is better solution, I will post the information here.

     

    Regards,

    Wednesday, September 26, 2007 2:47 AM