HTA For Controlling Workstation Internet Access

[webman]

Attached is the public release of RPKiller. Please let me know what you think (ie. does it even work for you 8) )

 

The RPKiller Manual is also available separately in PDF format.

 

EDIT: Latest version: 1.2 (30.11.2005 09:30)

* Remote task listing now works (highlights "processes to kill" if they're running on remote machines)

* Ping function added to check for dead machines (when executing an action like Remote tasks) with 1 second timeout.

* "Kill Process" now uses WINMGMTS (quicker) rather than a batch file + taskkill.exe

* Browser (that is altered with CACLS.EXE) can be specified in a variable (line 45)

* Option added to include the "Process to kill" list with the Internet On/Off command

 

Coming soon: Wake On LAN; Option to use AD instead of flat-file room list; Settings stored in INI file instead of variables - no more editing the HTA should be necessary.

rpkiller-1.2.zip

[MkII]

I cant run the .hta! The file associations are correct - is it a security level issue?

[webman]

I cant run the .hta! The file associations are correct - is it a security level issue?

 

Probably, yes :?. I'm not using SP2/firewall atm... If you are, I'd perhaps look for "IE6 SP2 HTA" issues on Google as I can't test it with an SP2 machine.

[ChrisH]

Can you edit you message and put the working version up please .

[sahmeepee]

I managed to get this working as instructed in your message edit and it looks nice. Unfortunately Windows doesn't seem to let .hta files "run as..", so I have to be logged on under an admin account to do the good stuff (shutdown PCs etc). Anyone got any ideas?

 

Feature request: It would be hella cool if you could put a "prune" button down near "Select all" and "Select all" to ping (or similar) each of the listed PCs in turn and work out if they're turned on. Otherwise trying to shut down a whole room of PCs will almost certainly end in a VBScript error when it hits one that's already off.

 

Definitely keep at it!

 

PS: Wake-on-LAN would be nice too!

[webman]

I managed to get this working as instructed in your message edit and it looks nice. Unfortunately Windows doesn't seem to let .hta files "run as..", so I have to be logged on under an admin account to do the good stuff (shutdown PCs etc). Anyone got any ideas?

 

Feature request: It would be hella cool if you could put a "prune" button down near "Select all" and "Select all" to ping (or similar) each of the listed PCs in turn and work out if they're turned on. Otherwise trying to shut down a whole room of PCs will almost certainly end in a VBScript error when it hits one that's already off.

 

Definitely keep at it!

 

PS: Wake-on-LAN would be nice too!

 

Thanks very much for the ideas - I understand about the timeouts and it's something I'd like to introduce. We have a machine in one of the rooms and it slows things down.

 

As for WOL, I've already made an ASP version on our server which works great. /wol.asp?whs=true (wake whole site) turns on every machine in the school at 7:45am. This uses an ActiveX object downloaded from the web, and combines Active Directory, DHCP and DNS and a batch file scheduled on the server to update the CSV of MAC addresses - it can get a bit messy once machines start to get rebuilt etc. I'll investigate what other WOL options are out there and look at putting it into the script

 

There may be a way to specify a username/password with elevated rights for certain tasks, but I'm not sure.

 

I'm already working on running task list for remote machines as well, shouldn't be long.

 

Our Network Manager would also like a script that'd clear ('X' amount of) profiles from workstations - anyone else after one of these?

 

In the mean time, thanks very much for the feedback and keep the suggestions coming

 

Latest version will re-posted at the top of the thread (incase we get more than 1 page on here )

[ajbritton]

Great work Webman!

 

Suggestions

 

- Link to AD to obtain computer names (use ADSI to query AD)

- Does the Internet block work for Firefox?

- Could the Internet block be achieved by renaming iexplore.exe (rather than CACLing it)? If so, it could be replaced by a small .EXE which says 'Internet is disabled' or something like that.

 

Finally a question, why HTA? You know you can get VisualBasic Express for free???

[webman]

Thanks ajbritton

 

- Link to AD to obtain computer names (use ADSI to query AD)

 

I could have a look at this - would certainly make life simpler in the long run. I've used loads of ADSI with ASP on the servers, hopefully it'll be as easy with VBScript.

 

- Does the Internet block work for Firefox?

 

No, but it could do. It's simply a matter of changing a few lines of code. I'll add a variable in the HTA you can change to specify your browser in the next version

 

- Could the Internet block be achieved by renaming iexplore.exe (rather than CACLing it)? If so, it could be replaced by a small .EXE which says 'Internet is disabled' or something like that.

 

I don't think this would work for a couple of reasons. First, a teacher may still want access to IE, whereas with CACLS it simply removes the student group. Secondly, IIRC, iexplore.exe is guarded with Win File Protection and would be replaced.

 

I wasn't aware of VisualBasic Express to be honest. I knew HTA, knew VBScript and wanted something that'd work no matter which machine one of us logged on to. It's definately something I'd consider using in the future though, thanks for the suggestion

[ChrisH]

Having it in this format as well would allow other people to contibute as well. I can do quiete a lot in VBScript and it's realted technologies but dont ask me to do the same in vb.net as everything is completely different and I havent got round to learning it much yet depite having the learning edition for a good few months now :oops:

[ajbritton]

@ChrisH: Lightweight ;-)

[ChrisH]

If time permitted I would of by now you work by yourself?

[StewartKnight]

I find that the "internet OFF" process only kills the current internet session, and that all you have to do is click on ie again, and you're back on the internet.

 

Is it just me, or should the internet be turned off permanently?

[webman]

Hi Stewart,

 

Part of the script should remove the read ACL for your student group on the network. You should see the following in the command window that opens:

 

processed file: K:\Program Files\Internet Explorer\IEXPLORE.EXE

processed file: K:\windows\system32\MSHTML.DLL

processed file: K:\program files\Windows Media Player\wmplayer.exe

processed file: K:\program files\Windows Media Player\mplayer2.exe

processed file: K:\windows\system32\atl.dll

 

You may need to get the exact name of your students group and add this to line 41/42 of the .HTA file.

[StewartKnight]

Hi Webman,

 

With a little tweaking, i've got the process list to look like yours, but the internet still doesn't remain off! Any ideas please?

 

Is there away of changing the script to point internet explorer to a null proxy?

[webman]

Hi Stewart,

 

You can test to see if it works by running it on your machine.

 

Remove IE 'read' ACL (Internet Off) (off.cmd)

@echo off
cacls "C:\program files\internet explorer\iexplore.exe" /e /d YOUR_USER_GROUP
pause.

 

Re-apply IE 'read' ACL (Internet On) (on.cmd)

@echo off
cacls "C:\program files\internet explorer\iexplore.exe" /e /p YOUR_NT_USERGROUP:r
pause.

 

Replace YOUR_NT_USERGROUP with the group you belong to. When running the Internet off - you should then no longer have rights to run iexplore.exe. You must also have admin rights to be able to use cacls.exe.

[StewartKnight]

Thanks for that webman, I got it running by denying all "users" which seems to work fine.

 

Totally locked myself out of internet explorer on my laptop whilst playing about with cacls though!!! :oops:

[webman]

hehe, it can be quite dangerous if used with the wrong switch

[StewartKnight]

quite! now how do I get internet explorer back! :?

[ChrisH]

Take ownership of it then change the ACL I would guess.

[webman]

cacls "C:\program files\internet explorer\iexplore.exe" /e /p YOUR_USERGROUP:r

 

Simply run that command using the same group name you removed it with.

[StewartKnight]

that didn't work, but I got the answer from microsoft, you have to enable propagation of inheritable permissions, and bobs your uncle!

 

We tried this at lunch, and the kids were most upset! I don't want to overuse it though, as they'll soon figure out how to bypass it, as I did when I'd borked the internet on my laptop!

[webman]

We tried this at lunch, and the kids were most upset! I don't want to overuse it though, as they'll soon figure out how to bypass it, as I did when I'd borked the internet on my laptop!

 

Out of curiousity, what or how will the kids be able to bypass it?

[Geoff]

Loading stuff through explorer is a favorite.

[ChrisH]

Hmm is that the case I was hoping that the dll blocked was something to do with launching web pages from explorer.

[webman]

Hmm.. yes, that's what I thought, about the MSHTA.DLL file. I'll have to test this out