Students are installing IM apps to their home folder

[bwallman]

Some student have figured out that they can install software to their home folder on the server. We have a Windows 2000 domain with XP clients, when students log on, the GPO locks the clients up tight (or so we thought). The two Instant Messaging apps they are usually installing are Trillian and Easy Messenger. We've been able to block most web sites that have the Easy Messenger file but Trillian is more of a pain.

Does anyone know you can prevent users from installing software to their home folder?

[ChrisH]

I think in your environment this might be your best bet.

[russdev]

also can be done with gpo having certain drives and locations set to allow list only

russ

[ChrisH]

Is that available in windows 2000 server I dont remember it being?

[bwallman]

also can be done with gpo having certain drives and locations set to allow list only

russ

Can you point me in the direction of how to go about doing this?

Thx

[russdev]

i kew people was going to ask that i didnt set this up here (as rm network) but it uses just standad windows 200 parts....

http://technet2.microsoft.com/Window...024b21033.mspx

but it has it advantages and disadvantages

remember to set allow to run all from programs dir...

it takes lot fo work to get it set up.

Russ

[_Bob_]

Pretty sure this is a 2k3 only thing. We use it here. Takes a bit of fiddling to set up, but works a treat.

[russdev]

aslong as clients are xp think it can be done...

well rm do it and they dont use anything different other than ms stuff

russ

[CyberNerd]

We solve this by allowing using an 'allowed applications' list in 2000 server.
Some antivirus solutions also allow only 'allowed' applications. (McAfee).
It is also possible to prevent certain applications (.exe etc) from being stored in certain areas using SAMBA and have it email you violations.

[pcprofessor]

two other relevant threads are: "blocking .exe" in the windows forum and "portable apps" in the general chat forum. the common answer seems to be the use of Software Restriction Policies.

[adamyoung]

You could run Nasty File Search on they're home dirs, this could be set to automatically delete DLL's, EXE's etc

For IM you could look into blocking the ports on your firewall.

[CyberNerd]

could use a samba filesystem and prevent .exe .dll from being stored on the homedrives. Many more options/possibilities with sama.

edit: lol I replied to the same post twice - I must be loosing it

[stejefferies]

ports can be changed in Trillian, or a port forwarding utility. another problem we have is there is an a level programming course, and they write in C (and some in assembler), C Sharp, and .NET.

pain when you look through the names.

we use a service that blocks pretty much anything on any port (unless we need it, and ask them), however another school i know, uses thier own ISA server to block everything. Brilliant.

[Geoff]

Linux box in bridging firewall mode can pick/block this stuff up too.

Alternatively you can passively monitor for it with snort assuming your switch(s) support port mirroring.

[TechMonkey]

If it's XP SP2 could you not use the built-in firewall to stop everything but what you specifically want?