Disable runas

[Norphy]

I think I'm losing my mind. I'm sure when I originally set up the student group policy there was a GPO setting in there which let you disable the runas command and I'm absolutely certain I set it. Now I can't find it and student have access to the RunAs thingamy in right click menus.

Did the thing exist or am I imagining things?

Cheers,

Norphy

[Geoff]

Removed in the XP SP2 ADM templates.

[Norphy]

Crud :|

Ah well, cheers m8

[Michael]

Does it really matter that Run as... is visible? The pupils still have to enter valid admin credentials. If you rename the domain administrator account and enforce a strong password (7 characters or more) then it's going to be a near impossible task.

On some shortcuts right clicking an icon doesn't automatically display Run as... however holding down Shift+right clicking the icon will then display Run as... A typical example to test this is with Paint Shop Pro 7's desktop shortcut

You can disable the context menu for the desktop -

User Config > Admin Templates > Windows Components > Windows Explorer. Now enable "Remove Windows Explorer's default context menu".

Now force the update - Start, Run and type gpupdate or logoff and log back on. The context menu should now be disabled, but for IE and Office (for example), the context menu is still accessible. Hope this helps.

[fooby]

Disable the secondary logon service

net stop "secondary logon" in a startup script or do it on the image.

This means it cannot run at all (also for other management things they can't do this either)

fooby

[Geoff]

I think this breaks remote desktop though?

[fooby]

let me test....

Nope, I disabled it on my box here and I can still remote to my servers

Graeme

p.s. Even if it did break RDP it would only be from places you dont want people to runas so you might not want them to rdp either (students pc's basically )