best way to protect anti-virus settings

[goldtech]

Hi,

I want to have it so a user can do just about anything they want BUT
they will not be able to change anything regarding the antivrus
program on a PC. Would the best way to do this is let the user be a
"poweruser" and set the AV to be only adjustable by an adminstrator
account.

Again, I want the user to have a liberal amount of freedom while
surfing the net. But the AV has to be able to update and run when it
supposed to and the user can't change anything about that. Note: this
is for a personal home PC not an big enterprise work station...

Thanks.

 

[Lanwench [MVP - Exchange]]

Hi,

I want to have it so a user can do just about anything they want BUT
they will not be able to change anything regarding the antivrus
program on a PC. Would the best way to do this is let the user be a
"poweruser" and set the AV to be only adjustable by an adminstrator
account.

Again, I want the user to have a liberal amount of freedom while
surfing the net. But the AV has to be able to update and run when it
supposed to and the user can't change anything about that. Note: this
is for a personal home PC not an big enterprise work station...

Thanks.

A power user in XP is pretty nearly an administrator. You can't prohibit an
administrator from doing anything.

There should be no reason for this user to have anything but user rights.
Surfing the web does nto require admin rights. The XP Security Console (by
Doug Knox) may help you further.

 

[wiliamtell]

Or access your security software controls and set password protect.

Good Luck!
WT

"Lanwench [MVP - Exchange]"

 

[Lanwench [MVP - Exchange]]

Or access your security software controls and set password protect.

Which won't stop them from stopping the Windows service(s)

Good Luck!
WT

"Lanwench [MVP - Exchange]"

A power user in XP is pretty nearly an administrator. You can't
prohibit an administrator from doing anything.

There should be no reason for this user to have anything but user
rights. Surfing the web does nto require admin rights. The XP
Security Console (by Doug Knox) may help you further.

 

[Lem]

Which won't stop them from stopping the Windows service(s)

Actually, it might. Some corporate antivirus apps have built-in
"self-protection" features that make it extremely difficult to disable
or otherwise mess with the a/v functions if the a/v "control console" is
password protected, including giving "access denied" errors when
attempting to stop services on which the a/v app relies. AFAIK, the
same is not true for the consumer versions of a/v apps.

The OP's question of how to keep users from changing a/v settings should
be directed to the vendors of "corporate" or "enterprise" a/v apps.

"Lanwench [MVP - Exchange]"

Hi,

I want to have it so a user can do just about anything they want BUT
they will not be able to change anything regarding the antivrus
program on a PC. Would the best way to do this is let the user be a
"poweruser" and set the AV to be only adjustable by an adminstrator
account.

Again, I want the user to have a liberal amount of freedom while
surfing the net. But the AV has to be able to update and run when it
supposed to and the user can't change anything about that. Note:
this is for a personal home PC not an big enterprise work station...

Thanks.
A power user in XP is pretty nearly an administrator. You can't
prohibit an administrator from doing anything.

There should be no reason for this user to have anything but user
rights. Surfing the web does nto require admin rights. The XP
Security Console (by Doug Knox) may help you further.

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

 

[wiliamtell]

Right on, Lem,
Thanks!
WT

Which won't stop them from stopping the Windows service(s)

Actually, it might. Some corporate antivirus apps have built-in
"self-protection" features that make it extremely difficult to disable or
otherwise mess with the a/v functions if the a/v "control console" is
password protected, including giving "access denied" errors when
attempting to stop services on which the a/v app relies. AFAIK, the same
is not true for the consumer versions of a/v apps.

The OP's question of how to keep users from changing a/v settings should
be directed to the vendors of "corporate" or "enterprise" a/v apps.

"Lanwench [MVP - Exchange]"
message Hi,

I want to have it so a user can do just about anything they want BUT
they will not be able to change anything regarding the antivrus
program on a PC. Would the best way to do this is let the user be a
"poweruser" and set the AV to be only adjustable by an adminstrator
account.

Again, I want the user to have a liberal amount of freedom while
surfing the net. But the AV has to be able to update and run when it
supposed to and the user can't change anything about that. Note:
this is for a personal home PC not an big enterprise work station...

Thanks.
A power user in XP is pretty nearly an administrator. You can't
prohibit an administrator from doing anything.

There should be no reason for this user to have anything but user
rights. Surfing the web does nto require admin rights. The XP
Security Console (by Doug Knox) may help you further.

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

 

[Lanwench [MVP - Exchange]]

Actually, it might. Some corporate antivirus apps have built-in
"self-protection" features that make it extremely difficult to disable
or otherwise mess with the a/v functions if the a/v "control console"
is password protected, including giving "access denied" errors when
attempting to stop services on which the a/v app relies. AFAIK, the
same is not true for the consumer versions of a/v apps.

Possibly, but I've used & supported many and I've never had a problem
stopping a Windows service as an admin.

The OP's question of how to keep users from changing a/v settings
should be directed to the vendors of "corporate" or "enterprise" a/v
apps.

"Lanwench [MVP - Exchange]"
message Hi,

I want to have it so a user can do just about anything they want
BUT they will not be able to change anything regarding the
antivrus program on a PC. Would the best way to do this is let
the user be a "poweruser" and set the AV to be only adjustable by
an adminstrator account.

Again, I want the user to have a liberal amount of freedom while
surfing the net. But the AV has to be able to update and run when
it supposed to and the user can't change anything about that.
Note: this is for a personal home PC not an big enterprise work
station... Thanks.
A power user in XP is pretty nearly an administrator. You can't
prohibit an administrator from doing anything.

There should be no reason for this user to have anything but user
rights. Surfing the web does nto require admin rights. The XP
Security Console (by Doug Knox) may help you further.