Locking down computers

Locking down computers

Secure Home | Search | About
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Locking down computers CJC 01-05-2006
Posted by CJC on January 5, 2006, 10:14 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi there,

This may be too much of a simple question for this board (well I hope
it is easy anyway) but at work we're looking at clamping down on our
PC's and want the following:

- Stop users using Messenger
- Stop users installing programs themselves.

In theory this does not sound hard, but here is the sticking point. We
have to allow users admin privlidges of the computer (not network), due
to an important program we use requires admin privlidges.

Plus our active directory is upon a windows 2000 server, which means
most of the good options which 2003 has we do not have (like disabling
messenger)

I have looked on the net, but probably missed all the good sites, but I
was hoping to find a solution within Active directory, or maybe a
script to stop it.

The main reason to wanting to do it centrally is so that I do not have
to go round to every PC and disable certain things.

Incase it helps the platforms of the PC's are XP professional.

Any help would be much appreciated.

Many thanks


Posted by Todd H. on January 5, 2006, 11:50 am
If you were  Registered and logged in, you could reply and use other advanced thread options

> Hi there,
>
> This may be too much of a simple question for this board (well I hope
> it is easy anyway) but at work we're looking at clamping down on our
> PC's and want the following:
>
> - Stop users using Messenger
> - Stop users installing programs themselves.
>
> In theory this does not sound hard, but here is the sticking point. We
> have to allow users admin privlidges of the computer (not network), due
> to an important program we use requires admin privlidges.

If it's an off the shelf program...what is it?

> Plus our active directory is upon a windows 2000 server, which means
> most of the good options which 2003 has we do not have (like
> disabling messenger)
>
> I have looked on the net, but probably missed all the good sites, but I
> was hoping to find a solution within Active directory, or maybe a
> script to stop it.
>
> The main reason to wanting to do it centrally is so that I do not have
> to go round to every PC and disable certain things.
>
> Incase it helps the platforms of the PC's are XP professional.

It does.

Have you looked into group policies?

--
Todd H.
http://www.toddh.net/

Posted by Frankster on January 5, 2006, 12:18 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Okay, I'm gonna type in caps, not because I'm yelling but because it is so
so important.

EVERY NETWORK MUST HAVE A --WRITTEN-- (and signed by the employee) SECURITY
POLICY AS TO WHAT IS ALLOWED AND DISALLOWED.

There are many approaches to network security, network use, and preventing
abuse. ONE is the written policy. ANOTHER is the technical enforcement of
that written policy WHEN POSSIBLE. If technical enforcement is not
possible, you enforce the WRITTEN POLICY of user CONDUCT (to which he as
agreed).

We trust employees with much more expensive things than using the messenger
service (usually). Let them take on this burden. They are paid to deal with
it. They can handle it. Or... they know the alternative (if you have a
written policy!).

-Frank

> Hi there,
>
> This may be too much of a simple question for this board (well I hope
> it is easy anyway) but at work we're looking at clamping down on our
> PC's and want the following:
>
> - Stop users using Messenger
> - Stop users installing programs themselves.
>
> In theory this does not sound hard, but here is the sticking point. We
> have to allow users admin privlidges of the computer (not network), due
> to an important program we use requires admin privlidges.
>
> Plus our active directory is upon a windows 2000 server, which means
> most of the good options which 2003 has we do not have (like disabling
> messenger)
>
> I have looked on the net, but probably missed all the good sites, but I
> was hoping to find a solution within Active directory, or maybe a
> script to stop it.
>
> The main reason to wanting to do it centrally is so that I do not have
> to go round to every PC and disable certain things.
>
> Incase it helps the platforms of the PC's are XP professional.
>
> Any help would be much appreciated.
>
> Many thanks
>



Posted by E. on January 5, 2006, 3:25 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
CJC wrote:
> Hi there,
>
> This may be too much of a simple question for this board (well I hope
> it is easy anyway) but at work we're looking at clamping down on our
> PC's and want the following:
>
> - Stop users using Messenger
> - Stop users installing programs themselves.

http://www.dougknox.com/xp/tips/xp_messenger_remove.htm
Try delivering via logon script.

You could also look into more inelegant solutions such as forcing win
mess to use a fixed port (registry flick via logon script) then blocking
that port(s) at the firewall.
>
> In theory this does not sound hard, but here is the sticking point. We
> have to allow users admin privlidges of the computer (not network), due
> to an important program we use requires admin privlidges.
>
> Plus our active directory is upon a windows 2000 server, which means
> most of the good options which 2003 has we do not have (like disabling
> messenger)

Have you updated the .adm templates?
http://www.microsoft.com/downloads/details.aspx?FamilyID=92759D4B-7112-4B6C-AD4A-BBF3802A5C9B&displaylang=en

> I have looked on the net, but probably missed all the good sites, but I
> was hoping to find a solution within Active directory, or maybe a
> script to stop it.
>
> The main reason to wanting to do it centrally is so that I do not have
> to go round to every PC and disable certain things.
>
> Incase it helps the platforms of the PC's are XP professional.
>
> Any help would be much appreciated.
>
> Many thanks

Personally what I would be doing is installing the problem app on a test
machine and experimenting with a lockdown in which the app will run
properly. Alternatively, you could try running the app in terminal
services/Citrix which would then allow you to set the local PC rights.

Also look at content filtering, esp with extension/download blocking.
There are a number of content filters, from IPCop running Cop+ to
Dansguardian to hardware based solutions. If no users can download any
executeable code in the first place, it makes if slightly more difficult
to install ;-)
E.



Posted by Unruh on January 7, 2006, 6:30 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

>Hi there,

>This may be too much of a simple question for this board (well I hope
>it is easy anyway) but at work we're looking at clamping down on our
>PC's and want the following:

>- Stop users using Messenger
>- Stop users installing programs themselves.

>In theory this does not sound hard, but here is the sticking point. We
>have to allow users admin privlidges of the computer (not network), due
>to an important program we use requires admin privlidges.

That is insane. Under linux I would advise using sudo to run that program,
but I have no idea if windows has the same kind of thing.
But what is it about the program that requires admin priviledges? Are you
sure? Once the person is admin, he cannot be stopped from doing anything.
You are finished.


>Plus our active directory is upon a windows 2000 server, which means
>most of the good options which 2003 has we do not have (like disabling
>messenger)

Put a later version onto that server. Sounds cheaper than you spending days
trying to do the impossible.


>I have looked on the net, but probably missed all the good sites, but I
>was hoping to find a solution within Active directory, or maybe a
>script to stop it.

>The main reason to wanting to do it centrally is so that I do not have
>to go round to every PC and disable certain things.

>Incase it helps the platforms of the PC's are XP professional.

>Any help would be much appreciated.

>Many thanks


Similar ThreadsPosted
How reliable is locking MAC address for Wi-Fi router? December 2, 2004, 1:00 pm
Locking/Limiting Internet Access for a Public Computer March 4, 2005, 10:10 am
computers November 11, 2005, 4:03 pm
computers are a security nightmare July 13, 2008, 7:23 am
Thought on disconnecting hacked computers December 5, 2005, 2:32 pm
U.S. Gov't to use Full Disk Encryption on All Computers December 29, 2006, 5:35 pm
Fraudsters stealing personal details from discarded computers August 18, 2006, 8:28 am
State Dept. to remove Chinese-made computers from classified networks May 22, 2006, 4:11 pm
Examination room computers accessed by tons of users: what's the answer? Biometrics? April 28, 2008, 2:44 pm

The site map in XML format XML site map

Contact Us | Privacy Policy