prohibit ro published application.

[newbie000]

There are some users who have NO access to published Microsoft powerpoint. They cannot see this powerpoint icon on their window. BUT when they click on a file with PPT extension, powerpoint opened (powerpoint is installed on the server - PS4 on W2K). That means user can just copy the correct file on their folder and use the program on the server even though they are not given the icon (we use only webinterface). Any suggestion ? thanks

 

[enigma99]

newbie000,
It sounds like you have Powerpoint installed (like how you mentioned) on your server.
It also sounds like you are publishing out individual applications (instead of the entire desktop) which means you have to publish each individual application.

I would create a global group that will have "Office" access and give that group rights to the published application.
Here are the steps:
1. Create your global group.
2. Add users to global group.
3. Create publish applications (ie..word, excel, powerpoint, outlook..etc..etc)
4. Assign global group to published applications.

This way when they launch web interface, and if they have access to the app, they will see all of those icons.

You also mentioned that they can still open PPT files. This is because the app is already there on the server and they simply can not see the icon. By publishing out the icon they will be able to see it within web interface.

Hope that kind of helps.

 

[newbie000]

Thanks but I think I wrote my problem not clear at all.
We don't gave all users the whole office application as packet.
The main problem is, we don't gave window media player to anyone and it is not published but it is installed on the server for IT guy to see some installation steps program. BUT when users click on any media file (mpeg, wma, avi, etc) the program is opened and user can play it. I tested a MS Visio file copied to one user's folder who have no access to this published program BUT this user can still open this Visio program !
Seem like we have to install separate programs by server !

 

[enigma99]

So it sounds like you want to restrict access to what programs users can execute while in a published application...correct?

So if you give them Word you don't want them to be able to launch Excel, Media Player and any other application.

I would simply lock down the programs with NTFS permissions.
Remove the "everyone" group and "users" group from the actual .exe's.

That way they won't have rights to open the actual .exe.
You can try it out and see what it does.

Hope that helps.

 

[newbie000]

Thanks. We use AD to control all access to published programs and was trying to find way to make it simple. Thank a lot. I'll try what you said.