Restrict direct access to drives

[akhileshbc]

Hi...

Is there any workaround in WindowsXP to restrict direct access to harddisk drives (partitions) ?

Some guys are misusing the data in the drives. So, I'm going to create a program to start other programs (a list of three for ten), in the meantime the drive would be restricting direct access..

I mean, no one could directly open drives and locate the installed programs. But only through my program (which I will create in VB) which will list the programs that are allowed to use.

Thanks

[Pradeep1210]

1. Restrict access to the drives with appropriate permissions and password.
2. Run your program with elevated privileges.

[akhileshbc]

1. Restrict access to the drives with appropriate permissions and password.
2. Run your program with elevated privileges.

Thanks

Could you please shed some more light on these 2 ideas ?

Do I have to change registry settings ? Or, do I have to block the drives by using some third party programs like FolderLock ?

[TheBigB]

Do you have XP Home or Pro?

[akhileshbc]

Do you have XP Home or Pro?

Windows XP Pro SP2

Thanks

[Lord Orwell]

if you have xp pro, you can simply set disk quotas for each user. they could still have a small area of disk for personal use if you wish (say, 100mb) but once it's full, that's that. You log on as admin and you can set it up easily. Here's a link that gives directions.
http://www.netadmintools.com/art160.html

[akhileshbc]

if you have xp pro, you can simply set disk quotas for each user. they could still have a small area of disk for personal use if you wish (say, 100mb) but once it's full, that's that. You log on as admin and you can set it up easily. Here's a link that gives directions.
http://www.netadmintools.com/art160.html

Thanks Lord

Does that mean we could prevent read access to other folders in the drive or just limiting the write access ?
(I couldn't test it in my system as it is for my uncle's new computer institute)

[Lord Orwell]

you can prevent read access to any user folder that doesn't belong to the current user. Also you can set encryption on individual folders as long as you don't have compression turned on. If an admin encrypts a folder, only an admin or higher can read it. (system is higher).

http://www.microsoft.com/resources/d....mspx?mfr=true

[akhileshbc]

Thanks

I'll explain my scenario in detail. In my uncle's computer centre, there are several machines where students used to learn, play games, etc...

Most of these people(these students) are a bit over smart and they would wander around each drive and folder, during our absence. So, my uncle asked me to create a program which will act as an interface. ie., the current user using that system won't be allowed to open any drives or folders. But if they want to open any software or game, they have to use my application which will allow the external application to be started. The main advantage is that, we could track what these students are using. ie., what all programs they have opened and how much time spent on that.

So, we could make sure that these guys are doing whatever we have asked to do (say, drawing a picture in MS Paint) and not doing anything else (say, playing NFS:Carbon)

So, what all things could be considered ?

I have already made the VB application which will act as an interface. The only thing remaining is how to restrict direct access but only through my VB application, for opening other programs.

[Lord Orwell]

well this really isn't that difficult. in xp, you can open win.ini (i think: it might be system.ini) and replace explorer.exe with your own program's name. This will replace the taskbar with your program completely so they would have no way to launch a program except by ctrl-alt-del, and you can disable THAT with a policy. I am not 100% positive this will stop the win-r from opening a run box, but i do know you can block that with a policy as well.

Whenever you have 10 or more computers, microsoft recommends you connect them through a domain. Any user can use any computer and all their user files will be on the domain server. You would have full microscopic control of what every user is doing, including what times of day they can log on.

[akhileshbc]

Thanks

I have tried testing that idea. But I didn't found the "explorer.exe" listed anywhere !

System.ini

; for 16-bit app support
[drivers]
wave=mmdrv.dll
timer=timer.drv
[mci]
[driver32]
[386enh]
woafont=dosapp.FON
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON
[vicax]
msacm711=78547
msacm811=162469
msacm911=42405

Win.ini

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
[MCI Extensions.BAK]
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
asf=MPEGVideo
asx=MPEGVideo
au=MPEGVideo
m1v=MPEGVideo
m3u=MPEGVideo
mp2=MPEGVideo
mp2v=MPEGVideo
mp3=MPEGVideo
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
snd=MPEGVideo
wax=MPEGVideo
wm=MPEGVideo
wma=MPEGVideo
wmv=MPEGVideo
wmx=MPEGVideo
wpl=MPEGVideo
wvx=MPEGVideo
[MSUCE]
Advanced=0
CodePage=Unicode
Font=Times New Roman
[SciCalc]
layout=0
[Compatibility16]
DXRCH=92038
SEKTVER=186885
R1CHMEDIA=42405
[Ans2000]
Pattern=92297
[annie]
WantPreview=1
UseFrameRate=1
FrameRate=333333
CaptureFile=X:\Documents and Settings\XXX\My Documents\12
VideoDevice2=@device:pnp:\\?\usb#vid_0c45&pid_612a#5&2f621ee5&0&1#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\global
AudioDevice2="@device:cm:{33D9A762-90C8-11D0-BD43-00A0C911CE86}\Realtek HD Audio Input"
CaptureAudio=1
CaptureCC=0
MasterStream=1
UseTimeLimit=0
TimeLimit=0

Whenever you have 10 or more computers, microsoft recommends you connect them through a domain. Any user can use any computer and all their user files will be on the domain server. You would have full microscopic control of what every user is doing, including what times of day they can log on.

I'll check that too...

[Lord Orwell]

google shell=explorer.exe
they moved it to the registry, and i forgot.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
it's in there.

[akhileshbc]

Thanks...
I'll check that

I have recently got some piece of code to lock screen. I have posted that in the CodeBank: http://www.vbforums.com/showthread.php?t=639579

But I didn't know the working of it. So, I consider there would be some disadvantages if I use that to lock the screen and allow the user select a program to run from that screen (kind of my own interface).

Yesterday, I created a thread asking for details on that code in here : http://www.vbforums.com/showthread.php?t=645776

What's your opinion ? If I use that code to lock the screen and allow the user to run programs like Photoshop, MSOffice, Games, etc.. will it be burden to the processor or RAM ? Or will it cause any conflicts ?

Thanks

[Lord Orwell]

it shouldn't cause any undue processing since the code only works with windows' built in functions for multiple desktops.

[akhileshbc]

it shouldn't cause any undue processing since the code only works with windows' built in functions for multiple desktops.

So, it's ok to use it for locking the screen as I needed ? I mean, a window will be shown (like UAC) and the user can select whatever application listed on that window and it starts that process ?