Windows XP SP2 Group Policy Security Center 1

[keepsmilin456]

Hey all,

I have deployed Windows XP SP2 to about 10 machines in our Windows 2000 based network for testing purposes. Since we already have a 3rd party firewall solution (at the hardware level), I do not want the windows based firewall so I went ahead and disabled that.

One thing I would like to do is to disable Security Center all together. I do not want the user to view this at all. I have played around with some settings in group policy and have disabled security center, but my client machines show a ballon on boot up: "Your computer might be at risk". When my users see this message, they seem to panic. Is there a way to remove Security Center all together so users do not see this in their system tray?

I have also disabled Windows Firewall through Group Policy and on my client in "Windows Firewall" only the General tab is grayed out. I'm assuming it will also disable the "Exceptions" and "Advanced Tab?"

Also, if removing Security Center is not possible, is their a way to disable or turn off the monitoring for "Virus Protection" through Group Policy?

Thanks in advance

 

[NetworkAdmin123]

it should be disabled but now your getting the wonderful balloons.

To Disable The Notification Area Balloon Tips
Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
Click Start, click Run, type regedit, and then press ENTER.
Navigate to the following subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Right-click the right pane, create a new DWORD value, and then name it EnableBalloonTips.
Double-click this new entry, and then give it a hexadecimal value of 0.
Quit Registry Editor. Log off Windows, and then log back on.
These steps disable all Notification Area balloon tips for this user. There is no way to disable balloon tips for specific programs only.

 

[bcastner]

Open notepad and create a new file to be called no_complain.reg and then copy/paste the below:

---------Start copy/paste below this line-------
REGEDIT4

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;
; Dont complain about the firewall being off.
;
; Also turns off anti-virus and Automatic Update warnings.
; Comment out the lines below as desired.
;

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallOverride"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

---------End cut here---------

Save the file and then double click it to merge with your registry. Reboot.

 

[keepsmilin456]

Thanks for your responses.

bcastner:
Is their a way to do this through group policy? I would hate to push out new reg keys to every machine. Also is their a way to turn off that annoying "Your document has been sent to the printer".

Thanks

 

[keepsmilin456]

I disabled the balloons through GP.
FYI, its located under

Domain Policy\User Configuration\Start Menu and Taskbar\Remove Balloon Tips on Start Menu.

I have enabled this but still am receving those annoying tips.

 

[bcastner]

Baloon tips are different from notifications, as you learned.

As for printer notifications, Open Printers and Faxes, File, Server Properties, Advanced and uncheck the notifications you do not want (look in particular to the lowest box).

 

[keepsmilin456]

Thanks...I wish MS would have a feature for this in GP. Is there a way to disable or turn off "Alert Settings" (from Security Center) through Group Policy instead of manually unchecking it?

 

[linney]

You can stop and disable the Security Center service and Windows Firewall service in Services.

 

[keepsmilin456]

This is what I created....

CLASS MACHINE
CATEGORY "Security Notifications"
POLICY !!DisableAVNotification
KEYNAME "Software\Microsoft\Security Center"
VALUENAME "AntiVirusDisableNotify"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY
POLICY !!DisableFWNotification
KEYNAME "Software\Microsoft\Security Center"
VALUENAME "FirewallDisableNotify"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY
POLICY !!DisableUPNotification
KEYNAME "Software\Microsoft\Security Center"
VALUENAME "UpdatesDisableNotify"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY
POLICY !!AVOverride
KEYNAME "Software\Microsoft\Security Center"
VALUENAME "AntiVirusOverride"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY
POLICY !!FWOverride
KEYNAME "Software\Microsoft\Security Center"
VALUENAME "FirewallOverride"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY
END CATEGORY



[strings]
DisableAVNotification="Disable Antivirus Notification"
DisableFWNotification="Disable Firewall Notification"
DisableUPNotification="Disable Updates Notification"
AVOverride="Disable Antivirus"
FWOverride="Disable Firewall"


MAKE SURE YOU INCLUDE in the above code to apply to machines XP SP2 or greater. I did not include that and now I have these reg entries domain wide including all win 2k servers!!! (BTW, if you don't include that, it will not hurt). ALSO, remember this procedure is also known as tatooing the registry..once this change has been made you cannot go back and enable it.

 

[bcastner]

Untatoo:

---------Start copy/paste below this line-------
REGEDIT4

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;
; Set Notifications back to SP2 defaults:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallOverride"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000

---------End cut here---------

 

[ltromans]

Hey BCastner

This is an old thread, but you get a star!!!

I just set up a new machine and could not clear the security warning. Usually, once you answer it the first time, you can "Change the way XP notifies You", but for some reason, this would not take. I was able to make the change, but upon restart it defaulted back. So I applied your no_complain.reg, and now everything is fine.

Thanks
Leslie