Need help with program restrictions and links

[Todd Prickett]

I caught my daughter running programs she has been told NOT to run.
So, I decided to do something about it. I changed her from an admin
to a user, then set the program policy to disallow any program from
running. Then, using the hashing method, I entered in the handful of
programs she IS allowed to run. So far, so good.

The problem I'm finding is that she cannot run any program by clicking
on a desktop shortcut, or running it from the start menu (i.e.
clicking on a link). She can run the appropriate programs by clicking
on the actual .exe.

So, I thought I'd allow execution of each link. So, I tried to setup
a hash for the links. The problem is that when I do that, the
program, trying to be helpful, enters an entry for the .exe, not the
..lnk. This leaves me in exactly the same situation of not being able
to run using links.

Is there something I'm missing here? Any help would be appreciated.

TIA

 

[Doug Knox MS-MVP]

Todd,

You may want to take a simpler approach. I'm assuming you're running XP Pro. All you need to do is to add her username to the Security Properties for each executable that you do not want her to run, then click the Deny boxes. You can also do the same for the folder that the program is installed in.

DO NOT use DENY on the Users Group. All users on the computer are members of this group, so Deny would apply to all users. Apply Deny permissions to specific Users.

XP PRO: In Windows Explorer, go to Tools, Folder Options, View and uncheck Use Simple File Sharing. Now, when you right click on a drive, folder or file (on an NTFS partition) and select Properties, you'll see a Security tab. Here you can assign or deny permissions based on user name or user group membership.

HOW TO: Set, View, Change, or Remove File and Folder Permissions in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308418

HOW TO: Set, View, Change, or Remove Special Permissions for Files and Folders
http://support.microsoft.com/default.aspx?scid=kb;EN-US;308419

HOW TO: Disable Simplified Sharing and Password-Protect a Shared Folder in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;307874

 

[Todd Prickett]

Thanks for the response Doug.

I actually did what you recommended originally. The problem is that
every time I DENY her execute on a program, she simply reinstalls it
elsewhere, or downloads a different, but similar program. It then
falls to me to track down what she is CURRENTLY running :-(

Its just way easier for me to have her have to request permission to
install/run new programs.

That's a good heads up on the DENY and Users group! That could have
been a pain! But, when I chose DENY, I also chose to not apply this
to administrators. Since there are only two users (me, an admin, and
her, a user) I don't see this as a problem.

 

[Doug Knox MS-MVP]

There is always Start, Run and enter LUSRMGR.MSC Go to the Users folder and open it. Double click on her username and select "Account is disabled". Leave it that way for a week or two.

 

[Todd Prickett]

LOL!

 

[Doug Knox MS-MVP]

Hey, got my kid off the "questionable material" sites