thomaswp

I got the wizmo working nicely using the trick of putting it in the login script in the GPO and passing parameters. This is beautiful. I thank you all.

Thanks. I know GRC from Shields Up over the years, and that also looks pretty useful. I'll look at that too!

Typo. I was talking about WDS with another friend (we are thinking about Win7). I meant RDS. It was 9pm when I was typing and I was not about to go back in to work to try. I thought that I could test it from home, but our RDS setup only allows me to RDS to the server which has no audio, so I suspect that I could not tell if audio was working on the workstation. I need to be stood in front of the machine. I will report back...

I will test that. If it works you have taught me something completely new and I thank you. I will report back. LATER: argh, can't do it with our RDS setup (long story and out of my control) and not back in school for a couple of days. Will report back.

No, that would throw an error (I checked, it does) since I think that the speech marks should enclose what goes in the Run box in Windows. Also, that little script works fine when executed manually. 'mute the sound CreateObject("WScript.Shell").Run """C:\Windows\nircmd.exe"" mutesysvolume 1" also works perfectly if executed manually. But neither work if put in the Computer boot script or the personal user login script.

I know that this is an ancient thread, but I am trying to get control of sound on boot/login. My test copies the nircmd files over to C:\Windows fine but it does not mute the speakers... 'mute the sound CreateObject("WScript.Shell").Run "C:\Windows\nircmd.exe mutesysvolume 1" Works perfectly when run on its own in a little vbs file but will not work if put in the users startup script OR in the machine boot script. Odd.

I am in Fairlie for a year or so. Beautiful. Big snow last year so waiting for the ski fields to open - this is why I am here... I am a proper Pommie though I just booted up with Ubuntu live CD and I could not get in without a password so I am not sure how he managed to do it. I have also managed to work out how to tell those PCs not to boot from a CD which is sad but I have reports to write and a network upgrade to manage and dealing with his (admittedly encouraged - I'd rather have him in the tent pissing out than outside the tent pissing in) attempts to subvert the system is quite time consuming.

I encourage the students to try Ubuntu, and when they try, they get straight in to the Staff shares including mine as Domain Admin using the standard Ubuntu connect to server functionality. I am burning a CD right now to test this. I am assuming (hoping!) that this is my fault and the security is set up wrong, but am a bit clueless to be honest. I have now put students DENIED on the share rather than simply ALLOW on the staff.

They are usually the ones I confiscated in the last lesson. Today it was Chelsea buns...

I pay him with sweets every time he shows me something...

Hmmm, I am sure I searched on "students unplug network lead". Ah well Thank you - I like the script version and will get it ready for testing tomorrow.

So, I have a clever student who is on-side and constantly looking for ways to defeat security. Everything he has found so far has been reasonably easy to fix. The latest is that if he logs in to the domain then immediately yanks the cable and then replaces it once he has the desktop then he ducks the GPO and scripts and gets the full start menu and access to RDS, C: drive etc. He can now see the server desktop but does not know the password of course. Any ideas how to beat this one? I've searched without much joy.

I'm on a jaunt in NZ for a year or so. I started naming the servers after local ski fields (fox, dobson, roundhill, ohau). I always wanted to be at a school where they close early to ski and that starts in a month. The school is tiny (<200 kids) so the four local ski fields will serve for now...

I have deployed the policy now. I did not put in the WUSB thing, just blocked all drives apart from C:, and added %UserProfile% too. This works nicely, but: - their "My Documents" is the X: drive and they are still able to execute exe files on that drive despite my disallowing x: and %HOMEDRIVE%%HOMEPATH%. - worse, one of the files that is run is automatically extracting an exe file to a temp folder in their user profile and running that with no problems despite it being on the %UserProfile% path I have just added \ to the end of the above AND added \\server\Student$\%USERNAME\ to the disallowed list. I have also added the name of the one exe I know of that so far that copies to the temp folder to my process tracking script mentioned above. It might put them off but is not a long term solution. I have also noticed that my login script no longer runs and throws a wscript error despite me making \\server\SYSVOL\domain\ unrestricted Later: with the changes described, everything started working. I worked out that the login error was my own process tracker being launched in to a temp file and being blocked by the policies which had started working properly.

Here you are: Things you need to change in <<>>. I am no Bill Gates but it does the job. I compile it to exe using VbsEdit. This does NOT stop it running as a WScript process however, it just makes it harder for them to find the source. I have been pondering rewriting it in C++ but I would need to learn it first Or AutoIT, or doing what is described in this thread as a first line of defence! ' Forbidden process tracker ' Thomas W-P ' First code based on ' Process.vbs ' Free Sample VBScript to discover which processes are running ' Author Guy Thomas http://computerperformance.co.uk/ ' -------------------------------------------------------' ' 'Command line Arguments: '0 - the path to the log file '1 - the wait time in seconds '2 - debugging (1 = true, anything else = false) Option Explicit Dim objWMIService, objProcess, colProcess, objFSO, objLogFile, wshNetwork Dim strComputer, strList, strNameOfUser, Return, strPathToLog, strComputerName, iWaitTimeSeconds Dim debugging, argu, dbStr 'constants can't be changed by code Const ForAppending = 8 'for the log save Const tryEmail = true 'default values that can be overridden by arguments strPathToLog = "<<>>" 'default argument 0 iWaitTimeSeconds = 15 'default time = argument 1 debugging = false 'argument 3 'does the command line switch on debugging? If Wscript.Arguments.Count > 2 Then If Wscript.Arguments(2) = "1" Then debugging = True End If If debugging Then dbStr = "Arguments found are:" & vbCrLf For Each argu In Wscript.Arguments dbStr = dbStr & argu & vbCrLf Next GoDebug dbStr End if 'set up variables Set wshNetwork = WScript.CreateObject( "WScript.Network" ) strComputerName = wshNetwork.ComputerName Set wshNetwork = Nothing 'initialise the object that will let us write a log file Set objFSO = CreateObject("Scripting.FileSystemObject") 'check and load the arguments If Wscript.Arguments.Count > 0 then If objFSO.FolderExists(Wscript.Arguments(0)) And Not Wscript.Arguments(0) = "null" Then strPathToLog = Wscript.Arguments(0) End If End If If Right(strPathToLog, 1) <> "\" Then strPathToLog = strPathToLog & "\" 'check if there is a second argument setting the seconds to wait If Wscript.Arguments.Count > 1 then If IsNumeric(Wscript.Arguments(1)) And Not Wscript.Arguments(1) = "null" Then iWaitTimeSeconds = Int(Wscript.Arguments(1)) End If 'debug what we have found so far GoDebug("Log: " & strPathToLog & strComputerName _ & ".csv" & vbCrLf & "Wait time: " & iWaitTimeSeconds & " seconds") 'prepare to get the list of processes Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2") strComputer = "." Do 'get the list of services Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process") 'run through processes checking the path For Each objProcess in colProcess 'if the path does not start with c, then get the user and write to file If LCase(Left(objProcess.ExecutablePath,1)) <> "c" _ And objProcess.ExecutablePath <> "<<>>" Then Return = objProcess.GetOwner(strNameOfUser) If Return <> 0 Then strNameOfUser = "unknown" End If GoDebug("strNameOfUser: " & strNameOfUser & _ ": Will try to kill " & objProcess.ExecutablePath) 'send an email? If tryEmail Then SendEmail strNameOfUser, objProcess.ExecutablePath, strComputerName 'write to the file Set objLogFile = objFSO.OpenTextFile(strPathToLog & strNameOfUser _ & ".csv", ForAppending, True) objLogFile.Write strNameOfUser & ", " & strComputerName & ", " & objProcess.ExecutablePath _ & ", " & FormatDateTime(now(),0) 'name, file, date/time objLogFile.writeline objLogFile.Close 'ensure it is closed and forgotten 'kill the process On Error Resume next objProcess.Terminate() On Error Goto 0 End if Next 'wait the given number of seconds WScript.Sleep iWaitTimeSeconds * 1000 Set colProcess = nothing Loop WScript.Quit '(won't get here if it is coded right) 'End of script 'sub routines 'debugging Sub GoDebug(strMessage) Dim m If Not debugging Then Exit sub m = MsgBox(strMessage & vbCrLf & vbCrLf & "Click [Cancel] to abort",49,"Process Tracker Debugging") Select Case m Case 2 WScript.Quit Case Else End select End Sub 'send email Sub SendEmail(strUser, strMessage, strComputer) Dim objEmail Set objEmail = CreateObject("CDO.Message") objEmail.From = "<<>>" objEmail.To = "<<>>" objEmail.Subject = strUser & " has been naughty." objEmail.Textbody = strUser & " was prevented from running the following application:" _ & vbCrLf & "Time: " & FormatDateTime(now(),0) _ & vbCrLf & "PC: " & strComputer _ & vbCrLF & "App: " & strMessage objEmail.Configuration.Fields.Item _ ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 objEmail.Configuration.Fields.Item _ ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = _ "<<>>" 'Modify to your SMTP Server Address objEmail.Configuration.Fields.Item _ ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25 objEmail.Configuration.Fields.Update objEmail.Send End Sub