Question about application access

[Carl]

Just a quick question... I have a few computers that i want
the user to ONLY be able to use internet explorer with.
Not be able to change any options (backgrounds,
screensavers etc). Just be able to browse the internet.

What's the best way to go about it?

 

[Tibor Biro]

How about some good old hacking?

You can change the shell on the computers from explorer to iexplore (you
must put in the full path to it like this: "c:\program files\internet
explorer\iexplore.exe" or wherever it is on your disk). After you
logout/login there will be no more icons or start bar, just Internet
Explorer.

The only way I know to break out of this on the local computer is by using
the task manager (CTRL+ALT+DEL or CTRL+SHIFT+ESC) and start a new process
from there. You can fix this by denying permissions to the regular user on
the tasgmgr.exe application. Or delete it. You can also connect remotely to
registry and put the explorer shell back.

So if this is what you want here's where you can change the shell:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Edit the Shell value to "c:\program files\internet explorer\iexplore.exe"

 

[Guest]

Sure, how do I deny access to task manager though? Sorry
for the stupid questions.

Interesting and simple solution though, never thought of
that.

 

[Michael Bednarek]

How about some good old hacking?

You can change the shell on the computers from explorer to iexplore [snip]
So if this is what you want here's where you can change the shell:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Edit the Shell value to "c:\program files\internet explorer\iexplore.exe"

Have you ever tried to enter "file://C:/" into IE's address bar? Or
menu: File/Open/Browse and double click on Explorer.exe?

 

[Tibor Biro]

Hi Michael,

You have some good points here, thanks for reminding me.

You could also download a file and execute it locally. Or
use an ActiveX control or some VBScript or JavaScript.

So many ways to skin a cat.

So how do you go about it? You could use the Internet
Explorer kiosk mode with an apropriate first page and
security settings.

"C:\Program Files\Internet Explorer\iexplore.exe" -k
http://www.google.com

Of course, the kiosk mode has some limitations so it might
not be appropriate.

--
Regards,
Tibor Biro
MCSE, MCDBA, MCSD
--------------------------------------
Please respond only to the Newsgroup and not directly to
me by email so that all may benefit from the information

-----Original Message-----

How about some good old hacking?

You can change the shell on the computers from explorer

to iexplore
[snip]

So if this is what you want here's where you can change the shell:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Edit the Shell value to "c:\program files\internet

explorer\iexplore.exe"

Have you ever tried to enter "file://C:/" into IE's address bar? Or
menu: File/Open/Browse and double click on Explorer.exe?

--
Michael Bednarek, IT Manager, Tactical Global Management
Waterfront Pl, Brisbane 4000, Australia. "POST NO BILLS"
http://mcmbednarek.tripod.com/
.

 

[Tibor Biro]

In Windows Explorer go to the file (taskmgr.exe), open
Properties, go to Security, add the user you want to
restrict and click Deny next to the Full Control
permission.

Also make sure you review Michael's comments about
security, it might make more sense to run IE in kiosk mode.

If kiosk mode is not appropriate for your case then you
could further restrict the user's access to key executable
files such as explorer.exe, regedit.exe, regedt32.exe,
mmc.exe and (probably many many) other.

 

[wcrouse]

Look up configuring Windows in kiosk mode. This is what you find in
public locations ensuring the user can surf, period.