Re: How To disable the LAN settings
From: Jeff Middleton [SBS-MVP] (jeff@cfisolutions.com)
Date: 06/10/02
- Next message: Michael J. Reeves, AA, ASc: "Re: Detecting spy software"
- Previous message: Arnt Karlsen: "Re: NT and security in the near future"
- In reply to: Alexander Edgren: "Re: How To disable the LAN settings"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Jeff Middleton [SBS-MVP]" <jeff@cfisolutions.com> Date: Mon, 10 Jun 2002 14:14:54 -0500
The answer to your question is pretty much the same thing as the previous
suggestion I made. Since all of these methods can disable it, each could
also enable it.
As for Proxy Settings, generally this applies to the settings in IE, which
are stored in the registry in location all programs refer to for "use
browser defaults" regarding proxy settings.
In the first case, I didn't interpret the issue to be a "lockdown" like a
kiosk, more a strong policy action, one that says "your proxy settings are
preset...leave them alone...I'm not showing you the place you might normally
expect to set them from." However, like many policies, you open Regedit and
you can whack those settings instantly. Plus, even with the proxy settings
page blocked, a different Group Policy can alter the content settings
because GUI control and Registry control are different issue.
As you are presenting your question, my thoughts would extend to say:
+ Use IE Reskit or Group Policy to prevent access to the IE Connections
Settings Panel.
+ Use Group Policies to prevent user from accessing the registry, the
Control Panel as a whole, or at least the specific Icons for Network
Settings and Internet Settings (though, this item is redundant here).
+ Additionally, Secure the registry by using Regedt32 to change the
permissions on the specific keys for IE Proxy Settings to all Authenticated
Users Read, but only Administrators (and possibly Power Users) to have
modify permissions.
This means that you have now locked out the specific (or entire) control
panel interface, you have secured the Proxy Settings keys in the registry
directly, and you have prevented the user from opening the registry editor
to examine what you did. This still isn't an air-tight solution, but you are
approaching a level of comfort that the Proxy Settings will be held in
place.
The problem is, you might have to go the next mile to really lockdown the
system if you have an aggressive situation to control. You would need to use
Group Policy (or regedits) to prevent use of the Run command, prevent access
to Add/Remove Programs, prevent the option to Change the Default Browser,
etc. Most of these things have nothing to do with browser security, they
have to do with workstation interface and user management as a whole. That's
part of the problem with answering security questions out of context. My
assumptions about the question may not be completely on target for the
mission.
"Alexander Edgren" <edgrale@NOSPAM.pp.htv.fi> wrote in message
news:uAraqkEECHA.1548@tkmsftngp05...
> But won't that restrict it to IE only?
>
>
> "Jeff Middleton [SBS-MVP]" <jeff@cfisolutions.com> wrote in message
> news:uJ$qlMAECHA.2576@tkmsftngp04...
> > This can be done through Group Policies in AD domain, through IE Reskit
> > tools, or through registry edits themselves.
> >
> >
> > "Branimir Petrovic" <nobody@nowhere.com> wrote in message
> > news:eu7wXw#DCHA.2096@tkmsftngp04...
> > >
> > > "Jose Chavez" <chaveztnb@hotmail.com> wrote in message
> > news:ca9a01c20fe7$40240680$19ef2ecf@tkmsftngxa01...
> > > > Hello,
> > > >
> > > > I want to disable the LAN settings so my clients cant
> > > > change any proxy settings..Anyone with an answer please
> > > > help..
> > > >
> > > > Jose.
> > >
> > > I do not think you can prevent/disable this possibility,
> > > but you could add proxy setting script to overwrite
> > > and "push" admin approved settings on each log on.
> > >
> > > Branimir
> > >
> > >
> >
> >
>
>
- Next message: Michael J. Reeves, AA, ASc: "Re: Detecting spy software"
- Previous message: Arnt Karlsen: "Re: NT and security in the near future"
- In reply to: Alexander Edgren: "Re: How To disable the LAN settings"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
