[HELP] Locking down XP SP2 - one problem

k, here is the story

got 2 support computers - they run various software our companies uses.

i would normally just set up the guest account or "user" based permission account - but one problem

the main sftware used will only run under administrative accounts

Even a "power user" account will not let the program update or run properly.

So, currently i am stuck with letting this 2 support system run with admin permissions on the accounts.

Now, it seems people dont listen - the team is only 5 people - but they dont bloddy listen!

i tell them dont install anything - then come in to find DivX installed . msn PLUS! which is a spyware haven program! and stupid yahoo games and crap and it DRIVES me mad

these are grown 25+ old people who can not follow basic instrcutions

SO, i come to OC to ask for help - wha i am asking is

1. is there a way to stop ALL .exe files from being installed? i know how to stop .msi installer via gpedit.msc so i did that
2. How can i lock down firefox security like IE - i have IE set to not allow downloads of files, or view bad pages and i locked it down so only the pages i specified can be viewed - password protected.


i tried to give full rights on the directories / files for our works programs - but they still won run

helppppppppppp before i kill dem all!!..

I am trying to read up on a domain controller - but that will involve a good hunk of $$$ and a new system - which i doubt i could get right now.

(last part was a joke)

Microsoft is way ahead of you and slightly behind everyone else. Its beta but I saw a cool video of it over at channel 9
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

It lets you completely lock down the windows C partition. No one can change anything. User profiles can be set to be erased everytime you reboot and no one can mess up the system.

As for administrative rights, XP has some other cool registry modifications. You can let someone have access to a key without being a poweruser or administrator. This often gets by the setting of having to be an administrator to run an app.

you may need to allow some keys in the registry for all users to have more access than they have by default. I'd try the applications registry keys first, try giving users full control. We have some touchy apps at work that require us to do this and they work well, once you find out which keys are required to have this done to.

Thanks, shall try it out, and that video is interesting..

now quick question - how do i give reg keys user permissions?

Right click on the key and give user permissions. You have to do it on the key (folder) not the dword etc.

awsome - shall use a monitoring program and install the app to see what reg files it creates