Potential Flaw in XP -- Start menu

[timbo343]

I know that XP has a few flaws, but in an educational evironment, this is medium to high. We disallow access to the C: tfor obvious reasons, but... users can still get to it... even though right click is disabled and users cannot get to c:. All they do is right click on all programs and then you have Open, Explore or properites. If you click on explore, you can get to all of c:.

 

My question is, does anyone know how to stop that either as a reg entry or via GPO.

 

Tim

[FN-GM]

There is a group policy that stops you from right clicking the start menu i will look when i get to a domain machine.

 

Z

[meastaugh1]

Are you using this policy? User Config>Admin Teplates>Windows Components>Windows Explorer> Prevent access to drives from my computer.

[sahmeepee]

The setting you're after is at:

 

User Configuration/Administrative Templates/Start Menu and Taskbar/Remove access to the context menus for the taskbar

 

You'll want that setting "enabled".

[timbo343]

thanks for all the replies,

 

@ meastaugh1 and shmeepee:

all these settings are set already. We have very tightly locked down accounts.

 

Any more suggestions

[FN-GM]

It should be ok then...

[timbo343]

nope, they still have the option to right click on all programs

[sahmeepee]

If you're still having difficulties, you could try something along these lines:

 

http://lists.webjunction.org/wjlists/web4lib/2001-July/036850.html

 

I've not tested it, so be careful! If something along those lines works, you can use a GPO to set the permissions on the relevant registry keys.

[timbo343]

Hey Hey, that might be it. Ill try it out on a machine at work 2morrow, i aint testing it at home. lol. Thanks alot. Will let you know if that sorts it.

[FN-GM]

Oh right you have Windows 2000, that’s a problem that’s with it. Microsoft decided against fixing it.

 

Its fixed in Windows XP though.

 

Z

[sahmeepee]

He's got XP according to the first post, but the reg keys are in the same place as win2k. The permission changes basically deny the user access to find out what program is executed when you choose "Explore" or "Open" so it fails.

[timbo343]

Yeah ive got XP but ill let you all know what happens

[timbo343]

If you're still having difficulties, you could try something along these lines:

 

http://lists.webjunction.org/wjlists/web4lib/2001-July/036850.html

 

I've not tested it, so be careful! If something along those lines works, you can use a GPO to set the permissions on the relevant registry keys.

 

This works!!!

 

Thank You!!

[projector1]

thanks for all the replies,

 

@ meastaugh1 and shmeepee:

all these settings are set already. We have very tightly locked down accounts.

 

Any more suggestions

 

if you are using gpo's to lock down the workstation then they should not be able to right click if you have configured that setting.

 

Are you using folder redirection?

We are using that and i know they can click the programs folder and that opens up explorer, their is a admin file on this site that fixes that but i have not had the chance to test it.

[Gatt]

We have this problem as well..

I have scoured the GPO's for right click settings and disabled all bar Internet Explorer, but right clicking the "All Programs" menu on the XP Stye start menu allows them access to the system (unfiltered!)

 

The only workaround I found was to enforce classic start menu's

[timbo343]

Also an alternative is to use the folowing in GPO:

 

User Configuration > Admin Templates > Windows Components > Windows Explorer >>>

 

Disbale:

Turn off shell protocol Protected Mode

 

Enable:

Prevent access to drives from My Computer

Choose C: Only.

 

When a user right clicks on the All Programs you will get (if configured correctly) Open, Explore and Properties... By Preventing access to the C: when a user clicks on explore you will get an error.

 

Tim

[azrael78]

We don't have this issue - we have a ton of GPOs enforced but the one we have set is 'force classic start menu'.

 

I don't see a need at all for anyone to have the XP start menu, so they don't get it.

 

If we ever go Vista - I will be enforcing that policy with Vista too.

[ajbritton]

Assuming your user accounts are 'standard' user accounts, then they cannot do any damage on the C: drive anyway. What's the problem?

[timbo343]

The fact that they could get to command.com and cmd.exe. If the kids were pretty bright, could get onto the network....

[ajbritton]

Is there something specific that you are worried about them doing on the network?

 

If you are trying to prevent them from executing unauthorised code then software restriction policies are the only watertight way of achieving this.

[timbo343]

Yeah, taking the whole network down, assessing private information.. ive been on a fair few security courses about this kind of thing and we were into systems via command line attacks, DNS attacks and attacks SQL Web databases.

We also have a tight software restriction policy in place, to the point where they cannot run exe files from pen drives, user areas and they cannot bring in zipped up exe files as that too has been blocked. You can not afford to relax on the security side of things. The courses i have been on shocked me!

[azrael78]

Yeah, taking the whole network down, assessing private information.. ive been on a fair few security courses about this kind of thing and we were into systems via command line attacks, DNS attacks and attacks SQL Web databases.

We also have a tight software restriction policy in place, to the point where they cannot run exe files from pen drives, user areas and they cannot bring in zipped up exe files as that too has been blocked. You can not afford to relax on the security side of things. The courses i have been on shocked me!

 

We are looking at using software restriction policies here too - any chance you could throw me a copy of your policy using GP Management Consoles' HTML reporting if you don't mind?

 

Az

[sahmeepee]

We are looking at using software restriction policies here too - any chance you could throw me a copy of your policy using GP Management Consoles' HTML reporting if you don't mind?

 

We use them here and it works quite nicely. Our setup is basically:

 

Block by default

Path rules for exceptions

 

Be aware that .lnk files (windows shortcuts) are classed as executables by default in software restriction policies

 

We don't create any path rules which would allow a user to run anything from a location they have write access to. e.g. they can run shortcuts in the all users start menu, but not shortcuts/exe files in their own.

[ajbritton]

Yeah, taking the whole network down, assessing private information.. ive been on a fair few security courses about this kind of thing and we were into systems via command line attacks, DNS attacks and attacks SQL Web databases.

We also have a tight software restriction policy in place, to the point where they cannot run exe files from pen drives, user areas and they cannot bring in zipped up exe files as that too has been blocked. You can not afford to relax on the security side of things. The courses i have been on shocked me!

 

Use SRP to restrict access to COMMAND.COM and CMD.EXE. No problem.

 

Use permissions to restrict access to private information. No problem.

[sidewinder]

I don't see a need at all for anyone to have the XP start menu, so they don't get it.

 

Same, always used classic here, gave a consistant interface when we were migrating from 2000 and there is just no need to change it. The Xp start menu adds nothing of value in a school environment