Trust Installer? Trying to disable calc

[speckytecky]

I'm trying to rename calc.exe so it's not available on our exam set up laptops. Trying to do it by renaming it but it refuses saying I need TrustInstaller Permissions to make the alteration?

[MordyT]

You will probably have to take ownership, then set permissions. Then rename.

 

Might be easier to just block it with GPO

[speckytecky]

Thanks @Mordy T - only problem there is I have taken the laptops off the network and they are in a workgroup now.

[speckytecky]

Muppet me! GP Management added through MMC. Doh!

 

However, where in GP do I disable Calc.exe

[sonofsanta]

Software Restriction Policy? Certainly the way to do it through network GPO so I assume it's in local GPO still. Computer Policies > Windows Settings > Security Settings > Software Restriction Policies, set a path rule to calc.exe

 

If you are messing about with local GPO don't forget to deny Read permission to local admin once you're done setting it up, so you don't brick the laptop!

Edited February 7, 2013 by sonofsanta

[MordyT]

Software Restriction Policy? Certainly the way to do it through network GPO so I assume it's in local GPO still. Computer Policies > Windows Settings > Security Settings > Software Restriction Policies, set a path rule to calc.exe

 

If you are messing about with local GPO don't forget to deny Read permission to local admin once you're done setting it up, so you don't brick the laptop!

 

I was always wondering about srp locally. How would you deny local admin permission to the GPO?

[sonofsanta]

I was always wondering about srp locally. How would you deny local admin permission to the GPO?

 

Just Deny read access to C:\Windows\system32\GroupPolicy for Local Admin group. You have to take if off every time you want to make a change, but so long as it's denied at logon the restrictions won't apply to the admin account.

 

Test this first - last time I used it was under XP, so make an inconsequential change first, log off & on to see if it works, then set the Deny and log off & on again to check.