Locking out software in XP

[NiX]

I'm trying to figure out how to lock out programs and downloading in a login. It's a basic user. I have the admin account and can access everything. Is there some way to do it within XP, do I need a program or is it just not possible?

[geldonyetich]

What you can do is go into your control panel>users and create a new account, and select "limited" as the type of account.  That account won't be able to do much, but neither will software it downloads that attempts to modify core windows files.

Personally, that's a bit of a hassle.  I just run around in administrator mode with an antivirus, firewall, anti-spyware program and only use Firefox and install trusted software.  That takes care of the vast majority of potential threats.

[Strazos]

I think what NiX is getting at is that someone else needs to use his PC, but he doesn't want them fucking with it when he is not looking.

In that case, Limited Accounts work fine. I currently do it on my PC for my mother and sister. With their accounts, they can download stuff, like music, but they cannot install anything. I think their access abilities are also limited.

[Sky]

Not sure about download limitations. Limited user will help, you can also lock them out of stuff with permissions. I'm using an early version of the Gates SCT, you can really lock a profile down, it adds some additional stuff like IE lockdowns. You can also download Office and Firefox lockdowns, all kinds of goodies. Don't know how involved you want to get :)

http://www.microsoft.com/windowsxp/sharedaccess/overview.mspx

[Yegolev]

You can disable execution of specific binaries by entering the name into registry keys here:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun

You just number the keys.  A sample from a regfile I exported:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun]
"1"="~2.EXE"
"2"="abaclient.exe"
"3"="abasetup150.exe"
"4"="abia.exe"
"5"="ac_abook.exe"
"6"="ac_help.exe"
"7"="ac_idmgr.exe"
...

If you need to, you can also set permissions on keys by right-clicking them in regedit.

[Sky]

How about downloads? Registry hack for that?

I'm putting together a kiosk that's pretty bulletproof, but another layer never hurts imo. Right now it uses IE as the shell with a program to relaunch it if the window is closed (no OS available to the user), with all data written to a partition that gets wiped on reboot.