+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 17
Windows Thread, Disabling 'Run Application' In Office XP in Technical; Maybe I've overlooked something somewhere, but I don't appear to be able to prevent the students from creating a new ...
  1. #1

    Join Date
    Oct 2005
    Location
    Corpus Christi Sports College
    Posts
    153
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Disabling 'Run Application' In Office XP

    Maybe I've overlooked something somewhere, but I don't appear to be able to prevent the students from creating a new command button and then linking in an executable file to it.

    For example I managed to do this with a student login:

    Opened access, clicked design new form, added a command button and went through the wizard to selecting 'run application' to open D:\firefox.exe (stored on removable storage). Then opened the form in view mode and clicked the button, firefox was launched and ran with higher permissions than it should have - firefox did warn me I didn't have the correct admin rights but it still got installed.

    I clicked turn off VBA in the office GPO but it appears to have had no effect.

    I am not going to disable removable storage either, since it is very useful for the 50% of kids without the internet at home.

  2. #2
    flyinghaggis's Avatar
    Join Date
    Jan 2006
    Posts
    994
    Thank Post
    99
    Thanked 70 Times in 57 Posts
    Rep Power
    114

    Re: Disabling 'Run Application' In Office XP

    We created a Software Restriction Policy GPO that stops users running executables from removable drives A: to G: and shared areas where users can write files to the network (my docs, subject shares,etc). Took as few days to fine tweak it but we sleep a lot more easily at night knowing pupils (and staff) can't run any .exe or script they feel like on the network. It's worked pretty well for us so far....

    I'd expect this would stop them from launching the app within Office documents aswell though admittedly I've not tried this yet?

  3. #3

    Join Date
    Oct 2005
    Location
    Corpus Christi Sports College
    Posts
    153
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Disabling 'Run Application' In Office XP

    Currently I have a software restrict policy that disables anything unless its a program from the start menu. So, I wouldn't have expected anything to be able to launch from within office. Of course I could just disable microsoft office but the teachers wouldn't like that one bit... like the resistance I received from a department for installing open office and they said they would still buy microsoft office.

  4. #4

    Join Date
    Feb 2006
    Posts
    1,187
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Disabling 'Run Application' In Office XP

    Are the reistrictions being imposed in the Computer section or User section of the GPO? Application restrictions in the User section only apply to th eapplications launched in the Explorer GUI shell i.e. by clicking on a shortcut or executable file icon.

  5. #5

    Join Date
    Oct 2005
    Location
    Corpus Christi Sports College
    Posts
    153
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Disabling 'Run Application' In Office XP

    They are being applied through User Configuration > Administrative Templates > System > Run only allowed Windows programs. I don't appear to have an option like this for the computer configuration on my Windows 2000 server.

  6. #6
    fooby's Avatar
    Join Date
    Dec 2005
    Posts
    351
    Thank Post
    0
    Thanked 5 Times in 4 Posts
    Rep Power
    19

    Re: Disabling 'Run Application' In Office XP

    Quote Originally Posted by Pear
    They are being applied through User Configuration > Administrative Templates > System > Run only allowed Windows programs. I don't appear to have an option like this for the computer configuration on my Windows 2000 server.
    This is a small list that looks at the process name "notepad.exe" somehow when office opens programs they automagically pass this list.

    What you can do is use Software Restriction Policies to lock them down (its a lot stronger)

    Try User Configuration > Windows Settings > Software Restriction Policies

    !! Read how to use this and test this in a different GPO first !!

    http://www.microsoft.com/technet/pro.../rstrplcy.mspx
    http://www.google.com/search?client=...utf-8&oe=utf-8

    fooby

    P.S I have gone nuts with this here no one runs anything unless I say so [evil sysadmin icon]

  7. #7

    Join Date
    Oct 2005
    Location
    Corpus Christi Sports College
    Posts
    153
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Disabling 'Run Application' In Office XP

    Note I said Windows 2000 server and not 2003, so I don't have those options and do not believe they are available to me after a quick search of google.

  8. #8

    Join Date
    Feb 2006
    Posts
    1,187
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Disabling 'Run Application' In Office XP

    Quote Originally Posted by Pear
    Note I said Windows 2000 server and not 2003, so I don't have those options and do not believe they are available to me after a quick search of google.
    Hmmm. I thought that Windows 2000 Active Directory had software restriction policies. If not then you could try Beyond Logic's Trust Not EXE . If having a sales contract and support matters to you then you could try standalone classroom policy servers such as Browse Control which has app blocking as well as URL management and yes Impero which is almost like NSM and NetOp but without demo/show screen mode.

  9. #9

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Disabling 'Run Application' In Office XP

    I thought that Windows 2000 Active Directory had software restriction policies.
    It will if you load the updated ADM templates from a XP SP2 machine. The easiest way to do this is to install the GPMC on one of your XP SP2 machines and load the GPO you want to 'upgrade'. The GPMC will do the magic and you will have the extra XP SP2 policies avalible to twiddle.

  10. #10

    Join Date
    Feb 2006
    Posts
    1,187
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Disabling 'Run Application' In Office XP

    Quote Originally Posted by Geoff
    I thought that Windows 2000 Active Directory had software restriction policies.
    It will if you load the updated ADM templates from a XP SP2 machine. The easiest way to do this is to install the GPMC on one of your XP SP2 machines and load the GPO you want to 'upgrade'. The GPMC will do the magic and you will have the extra XP SP2 policies avalible to twiddle.
    No not the policies in administrative templates but the ones in the Windows Settings-> Security Settings node of the GPO. The AMD restrictions apply to Explorer only hence the problem with Office.

  11. #11

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Disabling 'Run Application' In Office XP

    No not the policies in administrative templates but the ones in the Windows Settings-> Security Settings node of the GPO.
    You can still manage those settings from a XP SP2 machine running the GPMC.

  12. #12

    Join Date
    Feb 2006
    Posts
    1,187
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Disabling 'Run Application' In Office XP

    Thanks Geoff. That's good to know. Another arrow in the quiver etc. etc.

    But as his DC(s) is presumably on Windows 2000 Server with the corresponding backup software, won't that mean all the XP/Windows 2003 settings won't get backed up.

  13. #13

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,803
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Disabling 'Run Application' In Office XP

    yes they do. They live in the Sysvol share, which is on the server. It just means his Group Policy console on the server can't read the settings and will ignore them.

  14. #14

    john's Avatar
    Join Date
    Sep 2005
    Location
    London
    Posts
    10,513
    Thank Post
    1,493
    Thanked 1,050 Times in 919 Posts
    Rep Power
    302

    Re: Disabling 'Run Application' In Office XP

    A word of warning when doing the above with new ADMs, DO NOT OPEN YOUR GP on the server ever again! I did once on my old Win 2K one, and shall we say, I wore a mouse out clicking on all the OKs it threw up one after another saying cannot find X,Y and Z etc....

  15. #15

    Join Date
    Oct 2005
    Location
    Corpus Christi Sports College
    Posts
    153
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Disabling 'Run Application' In Office XP

    Been there before john, but I found a patch for that somewhere on the microsoft site, I'm sure someone will know where to find it. I used to just hold down enter until the messages disappeared.

    Thanks for the info guys, it sounds like the same problem I used to have to change the xp firewall settings - I can't see them on the server but I can if I load up XP laptop and connect into active directory - so I'm in the process of adding the restrictions now to see if they help.

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Disabling internet in one room.
    By eejit in forum Network and Classroom Management
    Replies: 161
    Last Post: 4th August 2010, 02:21 PM
  2. Disabling Internet on RM
    By rehanahmeds in forum Windows
    Replies: 5
    Last Post: 10th December 2009, 10:06 AM
  3. disabling Internet Access help!
    By Gardinho in forum Windows
    Replies: 3
    Last Post: 5th July 2007, 02:17 PM
  4. disabling spellcheck
    By Hecate in forum Educational Software
    Replies: 1
    Last Post: 21st May 2007, 02:32 PM
  5. Offline files keeps disabling by itself!
    By woody in forum Windows
    Replies: 1
    Last Post: 7th March 2007, 03:01 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •