Stopping "net send"

[SpuffMonkey]

Our little darlings have discovered how to use "net send". I thought I had capped this by denying the dos prompt, setting to Disable Windows Messenger in GPOs, denying "Run", etc, but no...

 

Any ideas on this one, that doesn't include visiting all PCs and stoping the service???

[Dos_Box]

Out of curiousity, how are they doing it?

[plexer]

If you have done the following:

 

http://lspservices.iupui.edu/docs/win2k/messenger.asp

 

To disable it via gpo then are you sure that the gpo settings have been applied?

 

Ben

[plexer]

Are they using a batch file to send messages?

 

Ben

[Ric_]

You need to disable the 'Messenger' service. This can be done with a GPO - somewhere under Security Setting IIRC.

[DMcCoy]

You can also change security for the command.com file from gpo if they are using this for net send

[SpuffMonkey]

Are they using a batch file to send messages?

 

Ben

 

Yep

[Norphy]

Disable the command prompt and prevent them from running batch files?

 

Implement a software restriction policy that only lets them run executables from the %programfiles% and %windir% folders and make sure they can't write to those folders?

[plexer]

Thought so. Follow the web link I gave you to disable the messenger service if you've done that allread and it's not disabled on the workstations then you have a problem with your gpo applying.

 

Ben

[petectid]

Are they using a batch file to send messages?

 

Ben

 

Our little darlings were using a program called netsend lite. See Here

[Michael]

Disabling the Messenger Service should stop any messages being sent across the network, no matter what method the children use. XP SP2 has the Messenger service disabled by default for your reference.

[SpuffMonkey]

Thought so. Follow the web link I gave you to disable the messenger service if you've done that allread and it's not disabled on the workstations then you have a problem with your gpo applying.

 

Ben

 

I take it that disabling the service doesn't cock up anything else??

[ChrisH]

Nope its fine without it. Infact my machines dont even have the service installed.

[pinemarten]

what if I need to send messages - (I often do this via vncon or net send) - can't do that with messenger service disabled !

[ChrisH]

what if I need to send messages - (I often do this via vncon or net send) - can't do that with messenger service disabled !

 

That is true and in that case you need an alternative you can lock down properly. Theres a recent thread around discussing alternatives, although I think no real good alternative had been suggested as of yet.

[pete]

you can choose to temporarily enable messenger service on the recipient computer to send a message and then disable it again. PFY has a script that does this I think - I'll post it if I remember tomorrow.