RE: Hardening Desktop

bob.r.bowden_at_bt.com
Date: 09/28/04

  • Next message: Tyson Leslie: "RE: VBScript to audit shares and share permissions"
    Date: Tue, 28 Sep 2004 16:46:13 +0100
    To: <thor@hammerofgod.com>, <laurarobinson@earthlink.net>, <focus-ms@securityfocus.com>
    
    

    You can use group policy to prevent redirecting to C: and use of the
    taskbar.

    You can also use it to specify logon and logoff scripts that could
    disable a USB keyboard for example at logon, and then enable it again at
    logoff. This policy could be set to only apply to your restricted users.

    Rgds

    Bob

    -----Original Message-----
    From: Thor [mailto:thor@hammerofgod.com]
    Sent: 28 September 2004 02:37
    To: Laura A. Robinson; focus-ms@securityfocus.com
    Subject: Re: Hardening Desktop

    The OP never really said anything about it being a kiosk setup-- I got
    from
    the "when a user logs into my machine, do this" kind of thing, meaning
    he
    wanted special behavior for a user or users, but not "him." Don't
    know...

    t

    ----- Original Message -----
    From: "Laura A. Robinson" <laurarobinson@earthlink.net>
    To: "'Thor'" <thor@hammerofgod.com>; <focus-ms@securityfocus.com>
    Sent: Monday, September 27, 2004 6:08 AM
    Subject: RE: Hardening Desktop

    > My question is, why even attach a keyboard at all? Disable it in the
    > BIOS and don't have it at all if this is supposed to be a mouse-only
    > kiosk. If you need to troubleshoot it, remote in.
    >
    > Laura
    >
    >> -----Original Message-----
    >> From: Thor [mailto:thor@hammerofgod.com]
    >> Sent: Tuesday, September 21, 2004 3:30 PM
    >> To: focus-ms@securityfocus.com
    >> Subject: Re: Hardening Desktop
    >>
    >>
    >> I guess my main question is, how do you expect to re-enable the
    >> keyboard so that the next user can log on?
    >>
    >>
    >> > On Fri, 17 Sep 2004 15:28:13 +0200, balyfix@tin.it
    >> <balyfix@tin.it> wrote:
    >> >> Hello,
    >> >>
    >> >> i need to hardening My windows 2000 desktop.
    >> >>
    >> >> When a user log on to my machine, start IE with a particular url
    >> >> and the user can' t :
    >> >> 1: Use the keyboard
    >> >> 2: use taskbar
    >> >> 3: Redirect the browser on C:\
    >> >>
    >> >> Is it possible ?
    >> >>
    >> >> I read some where that is possible with the registry command, but
    >> >> i want to know if there is a white paper.
    >> >>
    >> >> Thanks very much
    >> >>
    >> >> --Filippo
    >>
    >>
    >> --------------------------------------------------------------
    >> -------------
    >> --------------------------------------------------------------
    >> -------------
    >>
    >
    >
    > ----------------------------------------------------------------------
    > -----
    >
    ------------------------------------------------------------------------

    ---
    >
    >
    > 
    ------------------------------------------------------------------------
    ---
    ------------------------------------------------------------------------
    ---
    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------
    

  • Next message: Tyson Leslie: "RE: VBScript to audit shares and share permissions"

    Relevant Pages

    • AD Group Policy logon/logoff scripts not working
      ... So I modified the Group Policy and added a User Logoff script to run ... If I log into the servers and edit the LOCAL group policy, ... logoff scripts work perfect. ... Why won't logon/logoff scripts run from the Active Directory group ...
      (microsoft.public.windows.group_policy)
    • Re: 2003 server logoff script?
      ... Logoff scripts cannot be assigned to user objects (like logon scripts can). ... Instead, you must use Group Policy, which applies to an OU. ...
      (microsoft.public.windows.server.scripting)
    • Re: Monitoring a disconnected id
      ... Group policy will allow you to implement both logon and logoff scripts, ... create a logoff script that sends an email notification. ...
      (microsoft.public.windows.terminal_services)