Prevent Student Access To Command Prompt

[6Foot2]

Removed.

[Geoff]

Stop students from accessing word?

[maniac]

Not sure on a vanilla network, but anyone running ranger can do a title bar search on this, as I believe command prompt will still run with 'C:\windows\command.com' in the title bar, so program this in and as soon as ranger sees that in the title bar of a program it will close it.

 

Can't think of an immediate way with active directory, but I'm sure there is.

 

Mike.

[Jackd]

Wont the setting in the GPO do it,

User Configuration > Administrative templates > Sytem > Prevent access to the command prompt.

 

Or User Configuration > Administrative templates > Sytem > Dont run specified windows applications?

 

Jack

[Geoff]

Not sure on a vanilla network, but anyone running ranger can do a title bar search on this, as I believe command prompt will still run with 'C:\windows\command.com' in the title bar, so program this in and as soon as ranger sees that in the title bar of a program it will close it.

 

Stick the following in the nearest windows run box:

 

cmd /c start "wibble.exe" cmd

[sahmeepee]

Have you tried setting up software restriction policies in a GPO to block this? You may have difficulties if your login scripts run as a batch file although I'm guessing they don't.

[NetworkGeezer]

Stick the following in the nearest windows run box:

 

cmd /c start "wibble.exe" cmd

 

Ah but Ranger should stomp on the window of the original command window before it launches the second one.

 

Also the wibble command window stills shows executed commands in the titlebar.

[ITWombat]

with properties that students cannot access them, but System can. I suppose that is why it works [because the System is making the call to cmd.exe from inside Word, not the Student, if that makes sense] I dont think that I can deny access to System, so how do I prevent student doing this before it becomes a rash all over my network?

 

This can't be true or one of your students has just discovered a very serious security vulnerability in Microsoft Office.

System is the Windows equivalent of the root user in Unix. If someone one can get to run a command shell in the System context they own the box, game over, end of story.

 

The only protection might be to disbale unisgned macros from running in Word. Alternatively you can use a disk protection product like Deep Freeze or Microsoft's Shared compuer toolkit.

[6Foot2]

Removed.

[6Foot2]

Wont the setting in the GPO do it,

User Configuration > Administrative templates > Sytem > Prevent access to the command prompt.

 

Or User Configuration > Administrative templates > Sytem > Dont run specified windows applications?

 

Jack

 

Hi Jack,

 

Both restrctions already in place.

[Guest monkeyx]

:oops:

[6Foot2]

Removed.

[Guest monkeyx]

:oops:

[Stese]

Report it to Viglen....

 

it's a flaw in Classlink and they should be dealing with it, you have paid all that money after all!