preventing users from installing or downloading

[Guest]

I have a problem with some terminal server users managing to download and
install programs through Internet Explorer.
What policy do I modify to prevent this? or where is the policy to only
allow certian apps to run?

 

[Guest]

There are a couple of things you can do:

1. Set restrictive ACLs on directories & files, i.e. C:\, C:\Program Files,
C:\Windows,C:\Windows\System32 (this should be done when the system is first
built, as doing this retroactively can easily cause installed programs to
stop working. normal users usually do not need mere than Read & Execute
Permissions to these directories).

2. Use a software restriction policy, which specifically defines names of
authorized programs, others are blocked form execution.

Patrick Rouse
Microsoft MVP - Terminal Server
http://www.workthin.com

 

[Guest]

I have looked through the policies and can't find the one specific to
software restriction. I remember seeing it when I first set up the Win2k
server, just can't located now.

 

[Guest]

Group Policy Object -> Computer Configuration or User Configuration ->
Windows Settings -> Security Settings -> Software Restriction Policies

http://www.microsoft.com/resources/.../2003/all/techref/en-us/w2k3tr_gpsrp_what.asp

http://www.windowsecurity.com/articles/windows_2003_restriction_policies_security.html

 

[Guest]

That object does not exist in Windows 2000 server. I understand it would be
better to have Windows 2003 to assign rights and policies, but that is not an
option at this point.

Looks like I am SOL.

 

[Guest]

There are other options, i.e.

1. NTFS Security (work very well, just requires testing to make sure you
don't break anything by "over locking down".

2. 3rd party Applications that control application usage. Claudio
Rodrigues makes one called WTSApp that costs only $299, which might be right
up your alley. You can find it at terminal-services.net. Other more
expensive programs are made by triCerat and Appsense.

 

[Vera Noest [MVP]]

There is a similar tool in the W2K Resource Kit that might fit your
needs, although it isn't as easy to use as the 2003 Software
Restriction policy:

320181 - HOW TO: Use the Application Security Tool to Restrict
Access to Programs in Windows 2000 Terminal Services
http://support.microsoft.com/?kbid=320181

257980 - Appsec Tool in the Windows 2000 Resource Kit Is Missing
Critical Files
http://support.microsoft.com/?kbid=257980

 

[Guest]

Thanks, I couldn't remember the name of that thing.