QUESTION POSED ON: 15 January 2004
I am aware that a user should be assigned to relevant user groups like 'Authenticated Users' and so on. However, we have some legacy vendor applications that require administrative rights. For selected desktops, we installed the Device Lock software to prevent user access to removable devices like floppy drive. The problem is that a user belonging to the administrative group can stop the service locking the removable device and even install the Device Lock Manager to deactivate the device locking.
So far, I think the possible solutions to this problem are:
- Provide a limited user desktop by using system policy (WinNT) and LGPO (Win2000).
- Only allow icons to run apps.
- Restrict START/RUN.
- Disable the Command prompt.
- Disable File/Windows Explorer.
- Limit the Control Panel with no access to 'services'.
Is there anything else I can do to prevent the users from deactivating the Device Lock features?
|
