How are people installing programs on my CTX SVRs?!?!

[bran2235]

Hello everyone...

I publish a desktop (PS4 farm of 22 servers) to about 600 users.

I have randomly noticed that users (not admins) are able to install misc programs like chat programs, coupon hunters, etc. HOW IS THIS POSSIBLE?

I don't want to disable the MS INSTALLER service...

ANY SUGGESTSIONS???


Thanks,
Brandon

 

[patrickrouse]

This would be because the servers is not properly secured, or users are logging on with elevated accounts, i.e. power user or administrator. You'll find instructions on how to lock down your systems here:

http://www.sessioncomputing.com/security.htm

Patrick Rouse
Microsoft MVP - Terminal Server

http://www.sessioncomputing.com

 

[bran2235]

Hi Patrick- thanks for the reply...

I changed my NTFS settings to the following (SYSTEM ROOT):

Admin (Local) Full
Authent Users Read & Execute, List, Read
Creator Owner (blank)
System Full
TERMINAL SERVER USER (?)

The Terminal Server User has:
R&E, List, Read, and Write...

I also did the exact same thing on the Programs DIR...

Should I remove the Term Svr User from the ACL? The article / URL you posted above does not mention the TERMIANL SERVER USER account (win2003)...


MANY THANKS!
Brandon

 

[bran2235]

Ok,

After all the NTFS permission changes- nothing worked until I changed the Security Configuration settings in the Terminal Server Configuration to FULL.

Many thanks for the URL Reference... It's great!!


Brandon

 

[patrickrouse]

I would be very careful about doing any of this to a production server, as you're bound to break things that used to work w/ relaxed security. What is normally done is to start with a locked down system, install and test one application, relax security or alter the application as needed to run that one application, install another application... Once everything is tested and certified, make a system image (even better to make incremental images, so you can go back a step if something goes south during your build process)

On 2000 it was very easy to get applications to work on TS, as everyone had full control permissions to the root of the system drive by default. This however allowed users to install applications, delete files.... break your server.

Patrick Rouse
Microsoft MVP - Terminal Server

http://www.sessioncomputing.com