We recently discovered that an employee of our client was able to execute a "script" that prevented other users from logging into the server.
This is a Windows Server 2003 box and employees connect via thin clients.
When a user logs in there are a few scripts that run to setup printers, etc so disabling scripting all together is not an option.
I know how to disable Windows Script Host but am not sure how to prevent a user from executing DOS commands in a batch file. The users cannot start a command prompt but can create and run batch files.
Is there a way to disable DOS scripts (batch files) after the start up scripts have run? Scripting would also have to be enabled (on logout?) the next time the user logs in so the start up scripts can run.
What would you recommend? The goal is to prevent users from executing DOS and WSH scripts.
Disclaimer: I am not a sys admin. I am a programmer who has been asked to see if there is a programming/scripting solution to this problem.
My initial thoughts are to disable scripting after the start up scripts run and then enable scripting again on log out. This is based on my assumption that there are registry keys to control this stuff but I may be wrong so I am looking for advice.
Thanks for your help.
UPDATE After having a chat with my boss it appears that some of the security that was implemented around some areas was nothing more than hiding and disabling dialogs. So it is possible the employee attacking the server did not have have the proper permissions applied to their account. Classic case of obfuscation is not security. This is not known for sure but is a possibility. We are still simulating the client's environment and running some tests.
If anyone else has any suggestions I would still love to hear your comments.