XP Home User Accounts Issue

Finally got the hardware to get this gateway beast back up and running...owner requested 3 limited use accounts locked down as much as possible..some of you may recall I had previously found 20+ viruses/trojans, a couple dialers and 826 other critical problems ie: browser hijackers, bonzi buddy etc.

System has been formatted and upgraded to SP2..it's running like a dream. The problem I'm having is this: I have installed spyware blockers etc. on the admin account but none of what I have installed runs automatically on the additional user accounts. The only thing that does run is the AV software I put on here.

A.) How do I get these programs to run automatically on the additional accounts and is there any way possible I can prevent the users from changing the settings or shutting them down?

B.) Is there something I can install on the additional user accounts to prevent them from downloading and installing random crap...(password protected would be best if some kind of freeware is available) puter owner does not want them installing anything at all...just wants them to have the ability to play previously installed games, use a chat program, do homework and browse the net.

All suggestions welcome! I've had this beast here for a couple months waiting on parts and I want it outta here! lol

TIA!

 

Figured out I could do a little registry tweaking to get the proggies to run at startup on all accounts and was able to remove access to configuration of the proggies from all accounts except the admin account..Yeah! Go me! LOL I just have one program where I can't get rid of the icon in the system tray...any ideas on how I can do that?

Still looking for a way to prevent downloads/installs on the limited user accounts..suggestions?

 

Most installers won't run in limited accounts anyway, but I'll take a gander anyway

Downloads, you could set up the security settings and disallow file downloads in the "Internet" zone in Internet Options, Security (in IE) and then lock it out using a reg-tweak to the limited accounts.

 

I know a great many things won't install with a limited user account however in this case once I got into the puter originally it was obvious *cough* who was into the pRon, toolbars and other cute *gasp* things. So.....total download/install prevention is in order...lol

Can you clairify/specify a reg tweak? And would I do this on each limited account? The IE settings I got! Thanks Goldie!

 

*bump* Anyone?

 

Well, I know in Pro you can use gpedit.msc (Group Policy Editor) to change what menu items are available in IE, I'm sure there is a way to have that applied to a Home machine, via a reg tweak of some kind.

I've not got the time to find it right now, I'm shooting out but I'll have a look later.

As for preventing ActiveX, you can do that with security settings too. If you can't download the toolbars, it would be hard to install them, unless you got sent them on an IM or somthing by a "friend"... I'm sure there is a way to only allow varified executables to run on limited accounts... but I really cant remember how...

 

careful with gpedit though, you can lock out the administrator too.

 

Maybe you could use Audit to see what files/folders/registry keys the user needs to have access to for running the program. By enabling audit for the user and then let the user run the program, then the Event Log should show what files/folders/registry keys the user failed to get access to.

http://support.microsoft.com/kb/Q310399
http://support.microsoft.com/kb/Q300549

Though you might get into a situation where you open up for so much access, that the benefit from a limited user account is lost a little.

Just an idea, maybe you could add the limited user to the admin group, which would allow you to install the program properly for the user and then remove the limited user from the admin group. Maybe the program would be more willing to run afterwards.

Another solution could be to use "Run As".

http://support.microsoft.com/kb/Q294676
http://www.commandline.co.uk/sanur/
CPUA

And like Kodo said, it can be dangerous to play around with NTFS and registry security settings.

 

Yes, as I found myself locked out of my server when I set a logon script that logged you off. DOH.

 

does this help any? access enum v1.1