preventing users from installing unwanted apps 1

[coondog]

What is the best method to use on Win98 machines, to keep users from installing junk? The main problem is installations they click on when surfing the net. We are also using BorderManager to filter content, but we seem to be at least two steps behind. I would like to figure out how to better utilize ZENworks in this situation. I have considered only allowing them to run certain programs, but this would be a lengthy list. This is in a school K-12 environment.
Thanks for any help.
Rob

 

[Provogeek]

You did not state what version of ZENWorks you are using.

With Win98, your security option are basic and limited. To fully achieve what you want to do, you will need to go to Win2k or WinXP.

I don't even think setting up allowed programs to be executed will work in this case.

One thing I can think of that you can do is to create a custom IE install on the workstations. This you can deploy with ZENWorks. You can download the EIAK from M$ and create your custom install of IE. In this custom setup, you can lock down certain functions. Since you are using Win98, and Win98 does not use the new policy format introduced with WIn2k, this may be your only path to follow.

If you had Win2k and are using ZEN3, you can create an IE policy that will be sent to the workstations via ZEN. This can then lock down IE. Then there are the new GroupPolicies that M$ introduced and new versions of ZEN support, in GroupPolocies, you can specify program strings that are NOT allowed to execute.

 

[coondog]

Thanks for the reply.
We are still running version 3.2 but have version 4.0, just haven't had time to install it yet.
Do you have any suggestions on the areas of IE to tweak to solve my problem?
Rob

 

[RandallFlagg]

Hey CoonDawg:

I consulted for hospital that had the same problem. They used Fortres 101 (i.e. $$$). You could check out

http://library.rider.edu/scholarly/ecorrado/emanj/

If you have no $ to throw at the solution you could check out using NAL as the Windows Shell. Check this out

http://support.novell.com/cgi-bin/search/searchtid.cgi?/10016434.htm

You might want to check out centuriontech.com. They make a hardware product that is quite robust, from what I have read.

http://www.centuriontech.com/centurionguard.htm

I've never seen it in action, just read about it. Problem is it is quite alot of $$$ per gizmo, but could soon pay for itself, expecially in a school environment. Those little nippers are quite annoying...

If money is tight I recommend experimenting with the NAL as shell. But it won't solve the IE problems. Need to research more on policies etc.

Good luck.

 

[lerdalt]

There is a new feature within ZFD 4 called Rogue Process Management. Basically it is a series of registry keys to only allow applications that you specify. It works off of the parent ID number of the application so if you allow the Launcher window to be installed, anything launched from within it will work as well. However, if someone were to try and run an installation program (something downloaded off of the internet), the program will first try and run, but then shut down with a message box stating something about, this process has been terminated due to restrictions on the desktop.

I have seen this function work on W2k. I do not know for certain if it will work with W98, but it is really easy to setup a quick application object to push out the registry keys necessary.

 

[coondog]

Thanks for all of the excellent advice! I will check out each suggestion and see which one bests fits my situation. I think I will first pursue the Rogue Process Management. According to Novell's documentation, this will work on Win98 also.
Rob