Arkane
August 21st 05, 04:20 PM
Hi,
We've got a reasonably well-locked down site in terms of what our users can
and cannot do. Unfortunately it's not a corporate environment and discipline
for 'poking around' is next to non-existent I'm afraid.
What I'm looking to try and do is one of the following :
#1 Prevent ANY/ALL .lnk files from being run unless they're on Drive C:
#2 Prevent .lnk file creation by the users
I'm not sure how I can do either of these, #1 is a preference, as #2 can be
bypassed if the users create .lnk files on their floppy disks/USB memory
sticks.
I've even looked at writing a file system filter driver but I get the
feeling that's like using a tank to kill a fly...
Does anyone have any good ideas how I can do this? (We've disabled the file
menu in explorer, but they still seem to be able to create shortcuts).
I've seen you can use NTFS permissions to allow people to READ files but not
execute them, while this would be fine for network access, it wouldn't
prevent creation on floppy disk or USB memory stick.
Does anyone know of any good utils that may help with this?
Any ideas are welcome :)
Cheers,
Arkane
We've got a reasonably well-locked down site in terms of what our users can
and cannot do. Unfortunately it's not a corporate environment and discipline
for 'poking around' is next to non-existent I'm afraid.
What I'm looking to try and do is one of the following :
#1 Prevent ANY/ALL .lnk files from being run unless they're on Drive C:
#2 Prevent .lnk file creation by the users
I'm not sure how I can do either of these, #1 is a preference, as #2 can be
bypassed if the users create .lnk files on their floppy disks/USB memory
sticks.
I've even looked at writing a file system filter driver but I get the
feeling that's like using a tank to kill a fly...
Does anyone have any good ideas how I can do this? (We've disabled the file
menu in explorer, but they still seem to be able to create shortcuts).
I've seen you can use NTFS permissions to allow people to READ files but not
execute them, while this would be fine for network access, it wouldn't
prevent creation on floppy disk or USB memory stick.
Does anyone know of any good utils that may help with this?
Any ideas are welcome :)
Cheers,
Arkane