replace windows shell with application

[cybermax2]

Hi there

 

I saw a post from 3 years ago from SYNACK about modifying the shell in XP. He said modify local group policy by going to Computer Configuration > Administrative Templates > Windows Components > Windows Explorer : Turn off shell protocol protected mode

 

My question is how do you find computer configuration?

 

Regards

[6Foot2]

If you want to edit the local Group Policy click 'Start' and in the box that says 'Search programs and files' type:

 

gpedit.msc

 

and press return.

 

The local Group Policy will start after a short delay and will look as follows:

 

http://snag.gy/TdvUn.jpg

 

Computer Configuration is the top item.

 

HTH.

[cybermax2]

Thanks for that Dave that's just what I needed to know.

[6Foot2]

Thanks for that Dave that's just what I needed to know.

 

No problem. Glad to help.

[cybermax2]

Hi again Dave

 

Apparently you need XP professional to use this tool and I've got the home edition. Is there any solution other than upgrading?

 

Regards

[6Foot2]

...Apparently you need XP professional to use this tool and I've got the home edition. Is there any solution other than upgrading?...

 

Good question. Not sure how to answer this one as I haven't worked with XP Home. Perhaps someone else can help with this one. If not I will continue to investigate to see what I can dig up.

[Steve21]

Is this for a single pc, or deploying? Could just change the regkey that sets what "runs" first.

 

Edit - Think it is still under this for XP:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

 

There should be a shell=explorer.exe, just change it to your new exe etc

 

Steve

Edited July 21, 2012 by Steve21

[cybermax2]

Hi Steve

 

I am trying to set up a user account so that it automatically opens one program only and then exits on closing to the login prompt without anything else being accessible. Browsing the web I found an old post about using windows shell but the guy who tried it always got error messages. Then a helper suggested this solution which I am trying to get working but I have come up against the above problem with XP home.

 

 

"Although this thread is long since dead I may have come up with a way to make the shell mode work properly and so thought I would add it for refference.

 

It turns out that as part of XP SP2 they added something called shell protection mode to increase security. This restricts the shell applications access to a certain small subset of folders and files. This can be disabled in the local group policy on the computer by going to:

 

Computer Configuration > Administrative Templates > Windows Components > Windows Explorer : Turn off shell protocol protected mode

 

Hopefully this will work and act as a refference for anyone who might be trying this kind of thing in future. SYNACK"

 

Hope you can help.

[Steve21]

The way we do that for within things like exams is a bit of a cheat but seems to work ok. Using a VBS script during logon it autokills explorer and all child processes, then loads up the program we want (In this case we use wordpad).

 

It's set to auto reload wordpad every X seconds if it's not open, and obviously any normal way to get explorer re-running is disabled by normal GPOs (e.g. Run/Task manager etc)

 

Might be a thought if you want something simple/quick?

 

Steve

[SYNACK]

It turns out that as part of XP SP2 they added something called shell protection mode to increase security. This restricts the shell applications access to a certain small subset of folders and files. This can be disabled in the local group policy on the computer by going to:

 

Computer Configuration > Administrative Templates > Windows Components > Windows Explorer : Turn off shell protocol protected mode

@cybermax2 - Thats correct, the security measure was put in there to prevent other processes from acting as shell then chaining onto explorer, malware etc. Back when I was doing this we used this policy along with repalcing the shell for that particular user. We we had to redo it with Windows 7 and Vista things had changed a bit and the best way seemed to be to set the shell to a VBS scriptrun through cscript that triggered and waited for the process to complete. This was because the process we were using was java in a wrapper and as always with java was less than compatible with everything.

 

Applying the setting to just one user may be a bit tricky without GPO as there is no per-user local policy like in later versions. I think you can filter by admin/non-admin though so if most of your users log in as admin then this account being non-admin could be treated differently. I guess you could also use a VBS in place of the explorer.exe for all of the users as set in the registry/local policy that checked if the username was the required one then spawned and waited for either explorer.exe or your required process. That may be the easiest way. You'll want to run that through wscript though as that should make it transparent to the user that it is running at all.

[cybermax2]

hi Steve21

 

Would you have an example of the script you use and how to run it, as the guy 3 years ago tried and failed with both VBS and shell method.. I am by the way something of an amateur when it comes to programming and fiddling with the registry. I intend trying this on an old computer which doesn't matter if it gets screwed up.and thanks too to SYNACK for his imput.

 

Regards