Limiting XP users rights

[abaez]

Somehow my parents computer keeps getting spyware on it. I know its because my sister goes to teeny bopper websites and clicks yes on everything. My question is to how to limit a users access to just be able to open IE and office and do NOTHING else. No installation, no change backgrounds, no program saving or running.. nothing.. they have to be able to use hotmail and yahoo though.. thats pretty much it.. anyone have any idea where I could do this?

 

[n0cmonkey]

Make sure their usernames are not admins or power users. Use the native NTFS permissions to make sure they don't have access to anything else.

 

[abaez]

they are not admins.. where would i set native ntfs permissions?.. i dont want any installation of anything.. no resolution changing or desktop background changing.. nothing

 

[drag]

From my win98 days I know there are plenty of registry options that can turn off and on various parts of the OS for users.

Like turn off the ability to change screensavers, or gray out the resolution change bar, or hide the configureation panel, etc etc.


I figure there are the same things in WinXP, but good luck trying to find documentation for all that stuff.

Maybe there are some tweak applications that can do that registry hacking for you...

 

[lucky9]

user accounts in control panel should have their account. right click and choose security tab. go from there. you may have to change the account to linited before you can do this....and yolu may have to modify/fine tune the permissions to get what you want.

 

[abaez]

i cant right click on the security tab.. should I just use the guest account?

 

[CTho9305]

start->run gpedit.msc, poke around there

 

[Psych]

Do you have XP Pro or Home? Spyware generally has a tough time doing too much damage on a limited account, and has almost no chance on a guest account. What kind of spyware are we talking about?

 

[abaez]

pro.. the google spyware wher it goes to advertisements before the real google search.. and somehoe something got installed and popups every now and then.. plus sometimes web pages get redirected all of a suddent to marketing pages too.. i think i will just settle with guest account.. as long as they can reach office and browse thats all they care about..

 

[lucky9]

Sorry that was very unclear and also incorrect.

Since moving to Linux the old use-it-or-lose-it has reared it's ugly head.

 

[InlineFive]

See the link for the Spyware FAQ in my sig. The solutions inside should put a stopper on your problems.

 

[Psych]

If you want such strict policies to be enforced onto the kid's account, you are going to need to do quite a bit of permission changing. Software restriction policies would also be nice if they could just apply to a single account, but I don't think they do.

 

[MadRat]

Hell, just setup a local policy and lock down the USERS group. Don't make it any more complicated than it has to be.

 

[abaez]

MadRat.. anyplace I can read on setting up a local policy? I'm going to try to limit them and have them use opera or firefox so that most IE things/hacks don't cause a problem.

 

[Psych]

Too bad IE is an "essential and integral part of our [Windows] operating system." I think the best you can do is set the other browsers to be the default and maybe, MAYBE stick a SRP on iexplore.

Disclaimer: I am NOT responsible for any problem the aforementioned suggestion.

 

[sparkrainfire]

spyware blaster is a great program, it might be worth the subscription service on your parents machine, otherwise its free.

also spybot search and destroy has a 1.3 beta out right now, it comes with a program called 'tea timer' it moniters the reg for changes, and alerts you before it can harm the computer. (this is beta, might not be the best choice for your parents pc)

a browser like avant browser that has built in pop up stopping ablities could help too.

and last but not least, make the 'teeny boppin' sister a limited account, it wont help out a great deal, but alot of the malware wont beable to be installed on the c drive (just the documents and settings folders she will have write access to)

 

[MadRat]

Originally posted by: abaez
MadRat.. anyplace I can read on setting up a local policy? I'm going to try to limit them and have them use opera or firefox so that most IE things/hacks don't cause a problem.

Its really self explanatory if you go to the policy manager.

From CONTROL PANEL choose "Administrative Tools" and then select "Local Security Policy".

From there you just move groups or users in and out of the options.