Disabling 'Run Application' In Office XP

[Pear]

Maybe I've overlooked something somewhere, but I don't appear to be able to prevent the students from creating a new command button and then linking in an executable file to it.

 

For example I managed to do this with a student login:

 

Opened access, clicked design new form, added a command button and went through the wizard to selecting 'run application' to open D:\firefox.exe (stored on removable storage). Then opened the form in view mode and clicked the button, firefox was launched and ran with higher permissions than it should have - firefox did warn me I didn't have the correct admin rights but it still got installed.

 

I clicked turn off VBA in the office GPO but it appears to have had no effect.

 

I am not going to disable removable storage either, since it is very useful for the 50% of kids without the internet at home.

[flyinghaggis]

We created a Software Restriction Policy GPO that stops users running executables from removable drives A: to G: and shared areas where users can write files to the network (my docs, subject shares,etc). Took as few days to fine tweak it but we sleep a lot more easily at night knowing pupils (and staff) can't run any .exe or script they feel like on the network. It's worked pretty well for us so far....

 

I'd expect this would stop them from launching the app within Office documents aswell though admittedly I've not tried this yet?

[Pear]

Currently I have a software restrict policy that disables anything unless its a program from the start menu. So, I wouldn't have expected anything to be able to launch from within office. Of course I could just disable microsoft office but the teachers wouldn't like that one bit... like the resistance I received from a department for installing open office and they said they would still buy microsoft office.

[NetworkGeezer]

Are the reistrictions being imposed in the Computer section or User section of the GPO? Application restrictions in the User section only apply to th eapplications launched in the Explorer GUI shell i.e. by clicking on a shortcut or executable file icon.

[Pear]

They are being applied through User Configuration > Administrative Templates > System > Run only allowed Windows programs. I don't appear to have an option like this for the computer configuration on my Windows 2000 server.

[fooby]

They are being applied through User Configuration > Administrative Templates > System > Run only allowed Windows programs. I don't appear to have an option like this for the computer configuration on my Windows 2000 server.

 

This is a small list that looks at the process name "notepad.exe" somehow when office opens programs they automagically pass this list.

 

What you can do is use Software Restriction Policies to lock them down (its a lot stronger)

 

Try User Configuration > Windows Settings > Software Restriction Policies

 

!! Read how to use this and test this in a different GPO first !!

 

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

http://www.google.com/search?client=opera&rls=en&q=software+restriction+policies&sourceid=opera&ie=utf-8&oe=utf-8

 

fooby

 

P.S I have gone nuts with this here no one runs anything unless I say so [evil sysadmin icon]

[Pear]

Note I said Windows 2000 server and not 2003, so I don't have those options and do not believe they are available to me after a quick search of google.

[NetworkGeezer]

Note I said Windows 2000 server and not 2003, so I don't have those options and do not believe they are available to me after a quick search of google.

 

Hmmm. I thought that Windows 2000 Active Directory had software restriction policies. If not then you could try Beyond Logic's Trust Not EXE . If having a sales contract and support matters to you then you could try standalone classroom policy servers such as Browse Control which has app blocking as well as URL management and yes Impero which is almost like NSM and NetOp but without demo/show screen mode.

[Geoff]

I thought that Windows 2000 Active Directory had software restriction policies.

 

It will if you load the updated ADM templates from a XP SP2 machine. The easiest way to do this is to install the GPMC on one of your XP SP2 machines and load the GPO you want to 'upgrade'. The GPMC will do the magic and you will have the extra XP SP2 policies avalible to twiddle.

[NetworkGeezer]

I thought that Windows 2000 Active Directory had software restriction policies.

 

It will if you load the updated ADM templates from a XP SP2 machine. The easiest way to do this is to install the GPMC on one of your XP SP2 machines and load the GPO you want to 'upgrade'. The GPMC will do the magic and you will have the extra XP SP2 policies avalible to twiddle.

 

No not the policies in administrative templates but the ones in the Windows Settings-> Security Settings node of the GPO. The AMD restrictions apply to Explorer only hence the problem with Office.

[Geoff]

No not the policies in administrative templates but the ones in the Windows Settings-> Security Settings node of the GPO.

 

You can still manage those settings from a XP SP2 machine running the GPMC.

[NetworkGeezer]

Thanks Geoff. That's good to know. Another arrow in the quiver etc. etc.

 

But as his DC(s) is presumably on Windows 2000 Server with the corresponding backup software, won't that mean all the XP/Windows 2003 settings won't get backed up.

[Geoff]

yes they do. They live in the Sysvol share, which is on the server. It just means his Group Policy console on the server can't read the settings and will ignore them.

[john]

A word of warning when doing the above with new ADMs, DO NOT OPEN YOUR GP on the server ever again! I did once on my old Win 2K one, and shall we say, I wore a mouse out clicking on all the OKs it threw up one after another saying cannot find X,Y and Z etc....

[Pear]

Been there before john, but I found a patch for that somewhere on the microsoft site, I'm sure someone will know where to find it. I used to just hold down enter until the messages disappeared.

 

Thanks for the info guys, it sounds like the same problem I used to have to change the xp firewall settings - I can't see them on the server but I can if I load up XP laptop and connect into active directory - so I'm in the process of adding the restrictions now to see if they help.

[Geoff]

A word of warning when doing the above with new ADMs, DO NOT OPEN YOUR GP on the server ever again! I did once on my old Win 2K one, and shall we say, I wore a mouse out clicking on all the OKs it threw up one after another saying cannot find X,Y and Z etc....

 

Install the patch listed in KB 842933.

[john]

Why did I never find that when I needed it last year, but it doenst happen now with shiny 2003