How can I prevent a certain program from being run?

[Guest]

This is a 2-part question but I'd appreciate any help/ideas I can get:

1) I was wondering how an administrator can prevent a power user from
running a certain program if it is NOT an executable? Specifically I want to
block them from running a VBA program (has an extension of .dvb).

2) On a related note, how can I block running a program if it is in one
location, but they CAN run the file if in a different location? I'm trying
to prevent end users from running a program on the pc if it is not in the
server location that I specify.

THANKS IN ADVANCE

 

[Lawrence J. Gardner]

You can always change the Security Permissions on the executable so that
Power Users cannot execute it.

 

[Ronnie Vernon MVP]

You can explicitly set file/folder permissions to individual users and/or groups.

HOW TO Create and Configure User Accounts in Windows XP
http://support.microsoft.com/kb/279783

HOW TO Set, View, Change, or Remove File and Folder Permissions
http://support.microsoft.com/kb/308418

HOW TO Set, View, Change, or Remove Special Permissions for Files and
Folders
http://support.microsoft.com/kb/308419

HOW TO Set the My Documents Folder as Private in Windows XP
http://support.microsoft.com/kb/298399

Of course you can also encrypt the desired files/folders.

Best Practices for Encrypting File System
http://support.microsoft.com/kb/223316

Windows XP Professional File Sharing
http://www.practicallynetworked.com/sharing/xp_filesharing/index.htm

 

[Guest]

Unfortunately I already know all of these ideas but those don't address my
question. This is NOT and exe file, and it's not a matter of permissions.
Everybody has permissions to the programs I want them to use. What I want to
prevent is people from using any OTHER programs (once again these are not
..exe's). For example, I don't want them to bring in their own .dvb files and
be able to use them, only those that are on the server can be allowed. Does
this clarify things more?
Thanks.

 

[Ronnie Vernon MVP]

Cecilia

This may be possible using a group policy, but it is beyond the scope of my knowledge. Someone else here may know and respond or you could try posting in the microsoft.public.windows.group_policy newsgroup.

I'll try and draw some attention to this thread.

 

[Mark Dormer]

Look into Software Restriction Policies

***Do testing on a test domain, not your production domain, you can cause
serious problems with these things***

http://support.microsoft.com/kb/324036/en-us for a start

and take note of this
http://technet2.microsoft.com/Windo...f95b-4f08-9111-be2170d1956d1033.mspx?mfr=true

You can add .dvb to the Designated File Types
Then assign a path rule to allow those that reside on your server.


Regards
Mark Dormer

 

[cornedbeef007-groups]

I feel the answer is in Social Engineering.
Threaten with dismissal anyone who runs their own program!

Good luck.