Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Motivated initially by this article, there doesn't seem to be any reason to leave 16-bit execution enabled at all, but particularly on my DMZ, where anything that shrinks the attack surface just makes my day happier.

Disabling this is a snap in group policy - Computer Configuration/Policies/Administrative Templates/Windows Components/Application Compatibility/Prevent access to 16-bit applications

However, does anybody know where to find this in a non-domain joined computer, with only Local Security Settings? Or elsewhere?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

You can set this setting "manually" by adding a REG_DWORD value named "VDMDisallowed", set to "1", at "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppCompat". I'd just script using the REG command to set it:

REG ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /t REG_DWORD /v VDMDisallowed /d 1
share|improve this answer
    
Well yeah, you can do that, too. I'd go the script route, versus running GPEDIT.MSC "by hand" on the machines if you have any number of computers to do this to. –  Evan Anderson Jan 20 '10 at 15:13
    
That will be a big time-saver, thanks. Particularly since I don't seem to be finding it in the gpedit GUI, anyway. –  Kara Marfia Jan 20 '10 at 15:16
    
Just in the interests of completeness, the NT4 method seems to be working for win2000 - mskb220159 –  Kara Marfia Jan 20 '10 at 16:08

Tanks for the script, much easier - and quicker - than going through the registry and adding it manually.

Oops, my bad! First time commenting here, didn't see how to reply to the first answer.

Sorry!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.