Disable explorer.exe from running for specific user - Windows XP

[CHiLL]

I have computers setup to be dumb clients, but have noticed a security flaw through the Help files in mstsc.exe. (Can't disable them as they are within mstsc.exe). You can gain access to system features, including somewhere you can type C:\ and it will launch the C:\ drive, along with explorer.exe, which would give them limited access to the system.

 

Explorer.exe has been replaced with mstsc.exe upon startup/logon, so it doesn't start...but this...'exploit'...can be made to override that. I don't want the users to be able to start explorer.exe at all. I've tried putting it in Group Policy as a software restriction, but that effected all accounts, including the built-in administrator account which we need to be uneffected.

 

Is this possible?

[mac_shinobi]

In the

 

C:\windows\help

 

Directory - there are hlp / chm files - if you rename this directory or remove it altogether on one computer and test - does it fail to launch the help file

 

There is an mstsc.chm file

[CHiLL]

That worked great! Now the help is disabled. Still going through methods to break the system. Rather we broke it, than the students!

 

Thanks.

[mac_shinobi]

Is the help being disabled an issue ?

[glennda]

We have it set here using a registry hack - login as the user so a profile is created logout then login as an admin account. Load the Ntuser.dat from the user profile then change to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and change the Shell key to whichever program you would like rather then explorer

[CHiLL]

Is the help being disabled an issue ?

Yes, because through the help, you can launch explorer.exe. This is a problem because it is only a dumb client, running only mstsc connecting to our terminal server. We only want them using mstsc connecting to the server, nothing else.

 

We have it set here using a registry hack - login as the user so a profile is created logout then login as an admin account. Load the Ntuser.dat from the user profile then change to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and change the Shell key to whichever program you would like rather then explorer

That's what we've done. Instead of running explorer.exe running, we have a vbscript running, which launches mstsc (preconfigured to connect to our server). The script loops every 5 seconds to see if mstsc is still alive. If it is, it waits another 5 seconds. If it isn't alive, it starts the process, then waits another 5 seconds. This is repeated until the machine is turned off.

 

The local account used is locked down so the user cannot do anything. However, we noticed you could bypass this by going into Help from mstsc.exe. You could launch Internet Explorer, then from there launch a directory on the computer, which would launch explorer.exe (which wasn't already running). You could also get to this a couple of other ways, through the Help and through Windows Narrator.

[mac_shinobi]

Yes, because through the help, you can launch explorer.exe. This is a problem because it is only a dumb client, running only mstsc connecting to our terminal server. We only want them using mstsc connecting to the server, nothing else.

 

 

That's what we've done. Instead of running explorer.exe running, we have a vbscript running, which launches mstsc (preconfigured to connect to our server). The script loops every 5 seconds to see if mstsc is still alive. If it is, it waits another 5 seconds. If it isn't alive, it starts the process, then waits another 5 seconds. This is repeated until the machine is turned off.

 

The local account used is locked down so the user cannot do anything. However, we noticed you could bypass this by going into Help from mstsc.exe. You could launch Internet Explorer, then from there launch a directory on the computer, which would launch explorer.exe (which wasn't already running). You could also get to this a couple of other ways, through the Help and through Windows Narrator.

 

How do you load the ntuser.dat from said users profile whilst logged in as the admin ?

 

Also you said that it worked a treat when removing / renaming said directory because if they dont have the help files then they cant do the other bits through the help GUI

 

so if they dont have access to said help files then how is that an issue unless they require access to the help files in the first place ?

[glennda]

How do you load the ntuser.dat from said users profile whilst logged in as the admin ?

 

Open up regedit then select hkcu/hklm and the select file load hive - and navigate to the ntuser.dat file you can then make the changes

 

The local account used is locked down so the user cannot do anything. However, we noticed you could bypass this by going into Help from mstsc.exe. You could launch Internet Explorer, then from there launch a directory on the computer, which would launch explorer.exe (which wasn't already running). You could also get to this a couple of other ways, through the Help and through Windows Narrator.

 

can you not use the deny permission on explorer.exe for that user? then they shouldn't be able to run it.

[glennda]

double post my bad

[round2it]

try double click all programs from the start menu