Students accessing the Servers through Word

[indie]

With that setting enabled tho' students can still execute commands with batch files etc. Need to deny access to those extensions.

 

Not if you select the optional "Disable the command prompt script processing also?" section of the "Prevent access to the command prompt" object.

[Frazer]

Another way, for 'room' printers, is to change the security on the printer.

By adding PC_NAME$ instead of usernames, anyone logged into the specified machines can use the printer.

EG

Room T9 -> T9_Laser -> Properties -> Security:

Domain Admins full control

T9_01$ print only

T9_02$ print only

..

T9_30$ print only

T9_TUTOR$ print only

 

No student/pupil groups or usernames listed. Anyone typing \\PRINTSPOOL\T9_Laser from other machines (G3_07 for example) would get access denied.

 

@indie - You can package command.com into ms word and still get a command prompt even if you disable cmd from Group Policy - I used to do this when I was at school

[indie]

@indie - You can package command.com into ms word and still get a command prompt even if you disable cmd from Group Policy - I used to do this when I was at school

 

Very true, at very least command.com should be on the list of banned applications also.

 

I know kids can just rename command.com before they add it to the word file, but this should stop all but the most determined of children.

 

The other way round this, like what we do is run Windows XP x64 edition, command.com is a 16bit app that simply won't run no matter what you name it on 64bit systems. cmd.exe which is 32bit won't run whatever it is called as long as the group policy is set up.

[Alex]

not sure if this would work.....

 

you could add a explicit deny 'traverse folder / execute' permission to the group on files you dont want them executing.

 

I think that should work, deploying the permision should be possible via AD or a script.

 

I always had all the user home drives / my document redirections configured in this way - it stopped them executing batch files, because the only place they could save stuff, they couldn't execute from.

 

If you want to take it a step further you have to prevent them using removal media, because they can just execute stuff from there. Also possible with policies.

 

There's always ways round ofc.

[indie]

Wont that just stop them executing files saved in their user areas?

 

What about files embedded into word documends like command.com?

[Dos_Box]

Block command.com then.

[indie]

Only for them to rename it to notcommand.com then embed it into a word file? What windows needs is some sort of md5 matching so you can block programs that way.

[ChrisH]

You can do program hashing in the sftware restriction GPs.

[Norphy]

Assuming you're running XP of course