Win NT - How do I block ability to type in file path

Win NT - How do I block ability to type in file path
Secure Home | Search | About
Login Password
Register Now! Lost Password?

Microsoft Applications Security - Microsoft's general security discussions and announcements 

Bookmark this page:  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Win NT - How do I block ability to type in file path tribblesenterprise 03-07-2006
Posted by on March 7, 2006, 8:17 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I have 15 public computers which I thought I had secured.

Among other things, I had used the policy editor to block access to
viewing drives. But it turns out that just by going File\Save As or
File\Open in any software (in this case a help file) users can get in
to the system. If they click on the drop down arrow, they don't get
anywhere, but if they type in C:\winnt\system32 that works!

Does anybody know how to block access to the ability to do this?


Posted by Roger Abell [MVP] on March 7, 2006, 10:35 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Windows NT in not very well suited to the type of lockdown you
are attempting to accomplish. Kiosk type deployments are much
more approachable with Windows XP. You probably should
upgrade and then look into the use of group policy and software
restriction to effect kiosk style lockdown.

>I have 15 public computers which I thought I had secured.
>
> Among other things, I had used the policy editor to block access to
> viewing drives. But it turns out that just by going File\Save As or
> File\Open in any software (in this case a help file) users can get in
> to the system. If they click on the drop down arrow, they don't get
> anywhere, but if they type in C:\winnt\system32 that works!
>
> Does anybody know how to block access to the ability to do this?
>



Posted by on March 8, 2006, 12:36 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

Roger Abell [MVP] wrote:
> Windows NT in not very well suited to the type of lockdown you
> are attempting to accomplish. Kiosk type deployments are much
> more approachable with Windows XP. You probably should
> upgrade and then look into the use of group policy and software
> restriction to effect kiosk style lockdown.
>
> >I have 15 public computers which I thought I had secured.
> >
> > Among other things, I had used the policy editor to block access to
> > viewing drives. But it turns out that just by going File\Save As or
> > File\Open in any software (in this case a help file) users can get in
> > to the system. If they click on the drop down arrow, they don't get
> > anywhere, but if they type in C:\winnt\system32 that works!
> >
> > Does anybody know how to block access to the ability to do this?
> >

I realise that NT is not perfectly suitable, unfortunately I do not
have an option. I would even be happy with Win2k. But this is what I
have to work with in this situation...so I am still looking for ideas!


Posted by Scherbina Vladimir on March 8, 2006, 2:56 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
One of the idea is to buy (or write own) software that injects into system
(hooking API) and restricts user access. I don't remember the exact names of
the programs but I do remember the general scheme - an application is
providing it's own gui for iteracting with files, browser, etc. You cannot
close this application and cannot hide it - it is always opened and
maximazed...I guess, this hint will help you.

--
Vladimir
http://spaces.msn.com/vladimir-scherbina/

>
> Roger Abell [MVP] wrote:
>> Windows NT in not very well suited to the type of lockdown you
>> are attempting to accomplish. Kiosk type deployments are much
>> more approachable with Windows XP. You probably should
>> upgrade and then look into the use of group policy and software
>> restriction to effect kiosk style lockdown.
>>
>> >I have 15 public computers which I thought I had secured.
>> >
>> > Among other things, I had used the policy editor to block access to
>> > viewing drives. But it turns out that just by going File\Save As or
>> > File\Open in any software (in this case a help file) users can get in
>> > to the system. If they click on the drop down arrow, they don't get
>> > anywhere, but if they type in C:\winnt\system32 that works!
>> >
>> > Does anybody know how to block access to the ability to do this?
>> >
>
> I realise that NT is not perfectly suitable, unfortunately I do not
> have an option. I would even be happy with Win2k. But this is what I
> have to work with in this situation...so I am still looking for ideas!
>



Posted by Roger Abell [MVP] on March 8, 2006, 5:29 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

>
> Roger Abell [MVP] wrote:
>> Windows NT in not very well suited to the type of lockdown you
>> are attempting to accomplish. Kiosk type deployments are much
>> more approachable with Windows XP. You probably should
>> upgrade and then look into the use of group policy and software
>> restriction to effect kiosk style lockdown.
>>
>> >I have 15 public computers which I thought I had secured.
>> >
>> > Among other things, I had used the policy editor to block access to
>> > viewing drives. But it turns out that just by going File\Save As or
>> > File\Open in any software (in this case a help file) users can get in
>> > to the system. If they click on the drop down arrow, they don't get
>> > anywhere, but if they type in C:\winnt\system32 that works!
>> >
>> > Does anybody know how to block access to the ability to do this?
>> >
>
> I realise that NT is not perfectly suitable, unfortunately I do not
> have an option. I would even be happy with Win2k. But this is what I
> have to work with in this situation...so I am still looking for ideas!
>

I appreciate your situation, but the thrust of my comment was
that with NT 4 doing what you wish is virtually impossible.
Vladimir has pointed to the one most likely way by replacing
the default shell with your own, inescapable application.

Roger



Similar ThreadsPosted
Re: file type altre32.exe June 16, 2005, 11:18 am
file type altre32.exe June 7, 2005, 3:49 am
cannot access the specified device, path or file January 11, 2007, 4:54 pm
specific file path permission May 31, 2005, 7:41 am
Windows cannot access the specified device, path, or file." January 8, 2007, 2:54 pm
To prohibit creation or access of a particular file type? August 13, 2007, 9:52 pm
How block the file tranfer service from msn 7.5 March 14, 2006, 2:43 pm
MSN Messenger, File Transpher Security block November 22, 2005, 12:19 am
How to block file copy function transfer through the VPN. January 31, 2010, 8:39 pm
Limiting the ability to Move Items February 22, 2006, 4:37 pm

The site map in XML format XML site map

Contact Us | Privacy Policy