Prohibit write access to registry

[Guest]

Hello,

I work in a public access environment and need to find a way to prohibit
applications from being installed and being able to write to the registry. I
am using windows xp pro for the clients and windows 2k3 ad for the group
policy end. I am considering using the Desktop Standard (Autoprof) products
to see if I could lock this feature down.

Thanks in advance for any help given.

Shawn P.

 

[george]

Have you checked out
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/management/csws2003.mspx,
notable the Kiosk approach?

hth

george

 

[Guest]

It would be a mixed between the multi-user and kiosk. The desktop would be
standard throughtout the patron side of my organization where the number of
apps are the same except for the child profile that would not have the IE
icon on the desktop. I would just like not to have the downloading/running
of exe's, msi, bat, vbs, scr.....

I have websense content filtering working now but I would have to maintain a
yes list because AOL mail uses exe's for scripting in the browser.

I think creating a yes list in GP would probably work. I would like some
pro's and con's about this. Should I let my content filter do the exculsion
of the nasty extensions or let the OS & GP take care of the run list.

Thanks
Shawn