Securing a standalone workstation

From: Michael Quinlivan (mq_spam_acct_at_hotmail.com)
Date: 09/18/04 

Date: 17 Sep 2004 20:29:04 -0700

Hi All

I am wanting to know if it is possible to acheive the following. I
have a home computer that I want to share with others. Each user has
there own local user account. The machine is connected to the
Internet but is not on a domain. I want to be able to restrict them
so that the only folder visible on the machine is their respective My
Documents folder. I do this because firstly I want them to save all
data in ONE area only, not all over the hard disk. Secondly, I don't
want them to run certain programs. This means that they can only
"see" files that they have created, and cannot browse to any other
part of the filesystem. They are restricted to executing only those
applications present on the Start menu.

I have attempted to do this, but ran into some obstacles. I tried
using NTFS permissions to hide any folder and files except My
Documents, but to fully acheive this hiding breaks the applications on
the Start Menu. By disallowing them to see any files means that they
can not run the applications because they are invisible!!

I then tried relaxing the permissions on those files and folders that
are used by an application. This fixed the problem, but it now allows
anybody to delete certain application files, especially with legacy
applications. And what if I missed some files and programs that are
legit? It just seems to be a lot of messing around to me. Does
Windows have any concept of setuid, where you can run a program at a
privileged level? That way I could just hide everything on the drive,
exposing only application entry points that are run at a higher
privilege level allowing the application to run properly. Only
problem here is that if the application is running at higher privelege
level, a Save As dialog box may allow you to save to some part of the
file system that I don't want them to. Or are there any alternatives
to Windows Explorer that let you restrict drive access?

It seems with Windows it is impossible to have absolute control over
what happens, ther is always a compromise. Is this the case, or am I
just not knowledgeable enough about it? It seems all this would be
solved by simply having a server/shared drive where al documents can
be kept, and then just restricting access to C drive via Local Machine
Policy...

thanks in advance...

Relevant Pages

  • Re: Still looking for help on "Official" Apple Applications
    ... many of the Apple applications retain ... I have the following in my Applications folder: ... I don't have this installed as I didn't install Asian language support. ...
    (comp.sys.mac.apps)
  • Re: problem saving with Microsoft Word in Office 2004 on G5 with 10.3.7 OSX
    ... Popular sources of bother are where the Applications folder and the user's ... the temp folder, because Word performs a Write, Rename, Remove, Rename to ... > reinstalled Office 2004 from scratch on this virgin OS install. ...
    (microsoft.public.mac.office.word)
  • Re: Still looking for help on "Official" Apple Applications
    ... many of the Apple applications retain ... I have the following in my Applications folder: ... They are part of the retail iLife package. ... I don't have this installed as I didn't install Asian language support. ...
    (comp.sys.mac.apps)
  • Re: boot volume name change ?s
    ... Unix-derived and a lot of other Mac OS X native software doesn't even ... Applications written using the Carbon framework (including those ported ... the Applications folder on your boot volume is ... These applications should be using an alias to store any persistent ...
    (comp.sys.mac.system)
  • Re: Searching through Items with created Property (DisplayFormat = FALSE)
    ... You cannot use Restrict or Find unless the field has been added to the ... It's also not listed as a valid setting for the DisplayFormat ... AddToFolders is the argument that controls whether it's added to the folder, ... I would add the field to the folder and initialize it to a default value ...
    (microsoft.public.outlook.program_vba)