2

I'm a network administrator of a small/medium network.

I'm looking for a software (Free or Not) which can harden Windows Computers (XP And Win7) for the propose of hardening standalone desktop computers (not in domain network). Note: The computers are completely isolated (standalone), so i can't use active directory group policy. moreover, there are too many restriction that i need to apply, so it is not particle to set it up manual (one by one). Basically what I’m looking for is a software that can restrict and disable access for specific user accounts on the system.

For Example:

  1. User john can only open one application and nothing else -- He don’t see no icon on the desktop or start menu, except for one or two applications which i want to allow. He can't Right click on the desktop, the task-bar icons are not shown, there is no folder options, etc...

  2. User marry can open a specific application and copy data to one folder on D drive.

  3. User Dan, have access to all drives but cannot install software, and so on...

So far ,I've found only the following solutions, but they all seems to miss one or more feature: Desktop restriction Software 1. Faronics WINSelect The application seems to answer most of our needs except one feature which is very important to us but seems to be missing from WINSelect, which is "restriction per profile". WINSelect only allow to set up restrictions which are applied system-wide. If I have multiple user accounts on the system and want to apply different restrictions for each user, I cant.

  1. Deskman (No Restriction per user)-> Same thing, no restriction per profile.

  2. Desktop Security Rx -> not relevant, No Win7 Support.

  3. The only software that I've found which is offering a restriction per profile is " 1st Security Agent ". but its GUI is very complicated and not very intuitive.

It's worth to mention that I'm not looking for "Internet Kiosk software" although they share some features with the one I need. All I need is a software (like http://www.faronics.com/standard/winselect/) that is offering a way to restrict Windows user interface.

So if anybody know an Hardening software which allows to set-up user restrictions on Windows systems, It will be a big, big, big help for me!

Thanks to you all

5
  • Are these computers completely isolated (as in not on a shared network)? If not, have you taken a look at the native solution wich is Active Directory with Group Policies?
    – pauska
    Jun 23, 2011 at 11:49
  • Yes, the computers are completely isolated (stand alone), so i cant use active directory group policy. more over, there are too many restriction that i need to apply, so it is an particle to set it up manual (one by one).
    – MosheH
    Jun 23, 2011 at 11:58
  • Google around for "Windows kiosk software".
    – gravyface
    Jun 23, 2011 at 12:21
  • Hey, Windows kiosk software isnt intended to work on a stand Alone Desktops. and its settings are usually targeting computers that are connected to the internet. Thanks anyway
    – MosheH
    Jun 23, 2011 at 14:00
  • I Already have Active directory in my network, that is not the problem. as I mentioned, the computers are standalone computer (This is the requirement) and needs to be completely isolated from the network, so i can't/ Not allowed to use Active directory. I"m now checking the option to use "multiple local group policy" (techrepublic.com/blog/itdojo/…), but even if it will work it will be hard work to implement and not so easy to reverse. 10x
    – user85669
    Jun 25, 2011 at 7:11

2 Answers 2

1

Try using Local Security Policy, available in Control Panel>Administrative tools>Local Security Policy. This allows you to manipulate the local user and computer policy and edit all the settings you require. If every computer has the same requirements then you can use the File>Export utility on the first computer you configure, copy the resulting policy on to a USB pen and then file>import on another computer. Realistically, though, you need a domain, this is a very inefficient way of managing your computers and Active directory is the easiest way to do it. Maybe take a look at a 6 month trial of Microsoft Small Business Server 2011 ( http://www.microsoft.com/sbs/en/us/try-it.aspx and http://support.microsoft.com/kb/948472 to extend the trial)? This will allow you to test the software and give you time to convince your management that they need it.

With regards to limiting users's access to individual programs that is pretty tricky to be honest, you will need to use Software Restriction Policies which are a pain to set up and will need to be done per user as you cannot set up groups that span across your computers without Active Directory. Here's a MS KB to do so: http://technet.microsoft.com/en-us/library/bb457006.aspx.

0

follow this link to the lgpo section

http://blogs.technet.com/b/fdcc/archive/2010/01/15/updated-lgpo-utility-sources.aspx

2
  • I don't understand What should I do with The "GPO utility sources"?
    – MosheH
    Jun 23, 2011 at 15:35
  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – Scott Pack
    Jul 18, 2012 at 2:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .