Net Send

[thatrenowned]

We have a problem in that some users have discovered the net send command.

Is there a way to edit the policies and make it so that only Administrators can do this? I've never messed about with policies, and the Admins who usually do say they don't know how to do it.

One option is to disable the Run command, but I'd rather not do this.
Another is to disable the messenger service, but again, I'd rather not do this.

Any help appreciated.

Thanks

 

[johncurtis]

You could try playing with the permissions of net.exe.

BTW, I don't think that disabling the messenger service is the way to go - this will only stop the PC receiving messages. If a user can get to net.exe they can still send them.

John

 

[wolluf]

I don't think you can use policies for this on NT. Net Send is just one of the many Net commands (could try making net.exe inaccessible to said users, I suppose - but that would disable all net commands).

 

[DaveStL]

A technological issue does not always require a technological solution. Just add something to your company policies and send around a memo stating that unauthorized use of Net Send is prohibited and violators will be subject to disciplinary action. From that point on, you can address any specific abusers on a one-on-one basis.

 

[thatrenowned]

Thanks for the replies.

johncurtis - I don't think I would disable the messenger service anyway if it was the only choice...we actually use it quite a lot. For example when a server is getting rebooted, we email everyone to let them know the time and then remind them 5 minutes before with a net send.

DaveStL - The problem here is that they are sending the messages to each other so we can't tell when someone does it. The only way we will know is if someone accidentally sends a message to everyone.
I suppose we could send out an email telling everyone not to use the messenger service...

Thanks for your help

Regards

 

[cdogg]

Curiously enough, it seems that your usage of the "net send" command to send reminder messages has sparked some interest amongst your fellow employees! Believe me, even the common user is going to search around until they find out how to do it.

Bottom line: If you don't want others doing it, don't condone it with your actions!!




~cdogg

"The secret to creativity is knowing how to hide your sources."
- A. Einstein

 

[DaveStL]

Thatrenowned,

I'm not an admin, I'm an instructor, and we had a problem with a couple of students doing this in a class one day. It really got out of hand and they were distracting other students with their antics. After we requested they stop, they continued, so we went up through channels. Somehow, a log was obtained that documented their use of Net Send, and we were able to show this to their supervisor. I don't know how the log was obtained or how it was generated, but you might find out more by asking this question in the "NT 4.0 Server" forum. A log would allow you to monitor (and document) these activities.

Good Luck

 

[bierhunter]

The event viewer logs every net send message received on a PC and shows the from - to workstation names as well. They probably grabbed those logs and tied them to who was using what PC at what time.

 

[thatrenowned]

I discovered a problem which will prevent me from disabling the NET SEND command...

Our logon scripts have NET USE to map drives. If we disable NET.exe nobody can map drives...

Ah well...

 

[mudskipper]

Have you tried stopping the messenger service?

Perhaps put this into the login script:
net stop messenger Mudskipper
___________________________________________________________________________________

Groucho said it best- "A four year-old child could understand this! Quick! Run out and find me a four year-old child: I can't make heads nor tails out of this!"

 

[mudskipper]

Sorry, I know that you said that you didn't want to stop the service....

I was only thinking that if it was in the login scripts of those that don't need it, then everybody else (like your admins) can still use it.... Mudskipper
___________________________________________________________________________________

Groucho said it best- "A four year-old child could understand this! Quick! Run out and find me a four year-old child: I can't make heads nor tails out of this!"

 

[mudskipper]

Sorry for the many posts, but I find this interesting....

Although I have never tried to use doskey in this fashion, perhaps this person is on to something...it looks feasible.

http://groups.google.com/groups?q=w...TF-8&selm=#TxQyvQUBHA.1196@tkmsftngp03&rnum=7

Mudskipper
___________________________________________________________________________________

Groucho said it best- "A four year-old child could understand this! Quick! Run out and find me a four year-old child: I can't make heads nor tails out of this!"