Need help with program restrictions and links

I caught my daughter running programs she has been told NOT to run.
So, I decided to do something about it. I changed her from an admin
to a user, then set the program policy to disallow any program from
running. Then, using the hashing method, I entered in the handful of
programs she IS allowed to run. So far, so good.

The problem I'm finding is that she cannot run any program by clicking
on a desktop shortcut, or running it from the start menu (i.e.
clicking on a link). She can run the appropriate programs by clicking
on the actual .exe.

So, I thought I'd allow execution of each link. So, I tried to setup
a hash for the links. The problem is that when I do that, the
program, trying to be helpful, enters an entry for the .exe, not the
..lnk. This leaves me in exactly the same situation of not being able
to run using links.

Is there something I'm missing here? Any help would be appreciated.

TIA

Todd,

You may want to take a simpler approach. I'm assuming you're running XP Pro. All you need to do is to add her username to the Security Properties for each executable that you do not want her to run, then click the Deny boxes. You can also do the same for the folder that the program is installed in.

DO NOT use DENY on the Users Group. All users on the computer are members of this group, so Deny would apply to all users. Apply Deny permissions to specific Users.

XP PRO: In Windows Explorer, go to Tools, Folder Options, View and uncheck Use Simple File Sharing. Now, when you right click on a drive, folder or file (on an NTFS partition) and select Properties, you'll see a Security tab. Here you can assign or deny permissions based on user name or user group membership.

HOW TO: Set, View, Change, or Remove File and Folder Permissions in Windows XP
http://support.microsoft.com/defaul...kb;en-us;308418

HOW TO: Set, View, Change, or Remove Special Permissions for Files and Folders
http://support.microsoft.com/defaul...kb;EN-US;308419

HOW TO: Disable Simplified Sharing and Password-Protect a Shared Folder in Windows XP
http://support.microsoft.com/defaul...kb;EN-US;307874


--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"Todd Prickett" <QPCSDPTNTIYG@spammotel.com> wrote in message news:53fbe6fb.0407190651.131b12a8@posting.google.com...
>I caught my daughter running programs she has been told NOT to run.
> So, I decided to do something about it. I changed her from an admin
> to a user, then set the program policy to disallow any program from
> running. Then, using the hashing method, I entered in the handful of
> programs she IS allowed to run. So far, so good.
>
> The problem I'm finding is that she cannot run any program by clicking
> on a desktop shortcut, or running it from the start menu (i.e.
> clicking on a link). She can run the appropriate programs by clicking
> on the actual .exe.
>
> So, I thought I'd allow execution of each link. So, I tried to setup
> a hash for the links. The problem is that when I do that, the
> program, trying to be helpful, enters an entry for the .exe, not the
> .lnk. This leaves me in exactly the same situation of not being able
> to run using links.
>
> Is there something I'm missing here? Any help would be appreciated.
>
> TIA

Thanks for the response Doug.

I actually did what you recommended originally. The problem is that
every time I DENY her execute on a program, she simply reinstalls it
elsewhere, or downloads a different, but similar program. It then
falls to me to track down what she is CURRENTLY running :-(

Its just way easier for me to have her have to request permission to
install/run new programs.

That's a good heads up on the DENY and Users group! That could have
been a pain! But, when I chose DENY, I also chose to not apply this
to administrators. Since there are only two users (me, an admin, and
her, a user) I don't see this as a problem.


> Todd,
>
> You may want to take a simpler approach. I'm assuming you're running
> XP Pro. All you need to do is to add her username to the Security
> Properties for each executable that you do not want her to run, then
> click the Deny boxes. You can also do the same for the folder that the
> program is installed in.
>
> DO NOT use DENY on the Users Group. All users on the computer are
> members of this group, so Deny would apply to all users. Apply Deny
> permissions to specific Users.
>
> XP PRO: In Windows Explorer, go to Tools, Folder Options, View and
> uncheck Use Simple File Sharing. Now, when you right click on a drive,
> folder or file (on an NTFS partition) and select Properties, you'll see
> a Security tab. Here you can assign or deny permissions based on user
> name or user group membership.
>
> HOW TO: Set, View, Change, or Remove File and Folder Permissions in
> Windows XP
> http://support.microsoft.com/defaul...kb;en-us;308418
>
> HOW TO: Set, View, Change, or Remove Special Permissions for Files and
> Folders
> http://support.microsoft.com/defaul...kb;EN-US;308419
>
> HOW TO: Disable Simplified Sharing and Password-Protect a Shared Folder
> in Windows XP
> http://support.microsoft.com/defaul...kb;EN-US;307874

There is always Start, Run and enter LUSRMGR.MSC Go to the Users folder and open it. Double click on her username and select "Account is disabled". Leave it that way for a week or two.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"Todd Prickett" <QPCSDPTNTIYG@spammotel.com> wrote in message news:53fbe6fb.0407200503.54573c98@posting.google.com...
> Thanks for the response Doug.
>
> I actually did what you recommended originally. The problem is that
> every time I DENY her execute on a program, she simply reinstalls it
> elsewhere, or downloads a different, but similar program. It then
> falls to me to track down what she is CURRENTLY running :-(
>
> Its just way easier for me to have her have to request permission to
> install/run new programs.
>
> That's a good heads up on the DENY and Users group! That could have
> been a pain! But, when I chose DENY, I also chose to not apply this
> to administrators. Since there are only two users (me, an admin, and
> her, a user) I don't see this as a problem.
>
>
>> Todd,
>>
>> You may want to take a simpler approach. I'm assuming you're running
>> XP Pro. All you need to do is to add her username to the Security
>> Properties for each executable that you do not want her to run, then
>> click the Deny boxes. You can also do the same for the folder that the
>> program is installed in.
>>
>> DO NOT use DENY on the Users Group. All users on the computer are
>> members of this group, so Deny would apply to all users. Apply Deny
>> permissions to specific Users.
>>
>> XP PRO: In Windows Explorer, go to Tools, Folder Options, View and
>> uncheck Use Simple File Sharing. Now, when you right click on a drive,
>> folder or file (on an NTFS partition) and select Properties, you'll see
>> a Security tab. Here you can assign or deny permissions based on user
>> name or user group membership.
>>
>> HOW TO: Set, View, Change, or Remove File and Folder Permissions in
>> Windows XP
>> http://support.microsoft.com/defaul...kb;en-us;308418
>>
>> HOW TO: Set, View, Change, or Remove Special Permissions for Files and
>> Folders
>> http://support.microsoft.com/defaul...kb;EN-US;308419
>>
>> HOW TO: Disable Simplified Sharing and Password-Protect a Shared Folder
>> in Windows XP
>> http://support.microsoft.com/defaul...kb;EN-US;307874

LOL!

> There is always Start, Run and enter LUSRMGR.MSC Go to the Users
> folder and open it. Double click on her username and select "Account is
> disabled". Leave it that way for a week or two.
>

Hey, got my kid off the "questionable material" sites :-)

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"Todd Prickett" <QPCSDPTNTIYG@spammotel.com> wrote in message news:53fbe6fb.0407210428.34426fa9@posting.google.com...
> LOL!
>
>> There is always Start, Run and enter LUSRMGR.MSC Go to the Users
>> folder and open it. Double click on her username and select "Account is
>> disabled". Leave it that way for a week or two.
>>