Registry 1

[clubsceneuk2]

I am trying to lock some laptops down which have win XP Pro on them.
I would like to do it from the HKEY_USERS but can not locate the right user as there are 6 listings. We only have 2 users for each PC.
The reason i want to lock down in this area is so that i can remove the RUN option.

Any Ideas

 

[vanvb]

Any reason you are using the registry rather than setting up a local group policy?

 

[bcastner]

Start with this, a very well done discussion of the issue:

http://gd.tuwien.ac.at/pc/nsa-secguides/w2k_group_policy.pdf

If there are not Group Policy objects to cover a specific conern you may have, pleae advise.

A registry "push" can usually fix the issue, but see as a reference:

http://msdn.microsoft.com/library/d...w2kmag01/html/DistributingRegistryChanges.asp

 

[linney]

Any help?

292504 - Policy Settings for the Start Menu in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;292504&FR=1&PA=1&SD=HSCH

http://searchwin2000.techtarget.com/infoCenter/tip/0,294276,sid1_gci843035_tax288607,00.html

 

[vanvb]

Good link Linney. Star for that as I will find that usefull.

clubsceneuk2, keep in mind that while this can be done via the registry as Linney has pointed out, Group Policy exists to make any changes much more transparent to the administrator and easy to change and troubleshoot. In the end though, if you limit group policy to just the administrative template area, it is just a fancy gui for controlling registry changes so a lot of it can be done without GPO's.

 

[clubsceneuk2]

thanks for the tips. I attempted to use group policy but as they are stand alone machines each time i logged on as the admin or the user all options for both login were restricted.
This is why i wanted decided to use the registry.
Any thoughts??

 

[linney]

In what way is your login to these machines restricted, can you clarify what you mean?

 

[clubsceneuk2]

because the machines are local the registry changed the settings for all users.
IE remove run from the user it removes run from the admin too.

 

[linney]

See the second link I originally posted to prevent it applying to Administrators.

There is a check box in the Start Menu Properties where you can remove Run.

Policy:Remove Run item from Start Menu
Description:Removes the ability to execute programs from the Run option on the Start menu, Task Manager, or by pressing Winkey + R. Also removes the corresponding checkbox from the Start menu customization CPL.
Registry Value:"NoRun"

These registry settings are under the following registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

The registry entries are DWORD values. A value of 1 is enabled, and a value of 0 is disabled.