Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a network administrator of a small/medium network.

I'm looking for a software (Free or Not) which can harden Windows Computers (XP And Win7) for the propose of hardening standalone desktop computers (not in domain network). Note: The computers are completely isolated (standalone), so i can't use active directory group policy. moreover, there are too many restriction that i need to apply, so it is not particle to set it up manual (one by one). Basically what I’m looking for is a software that can restrict and disable access for specific user accounts on the system.

For Example:

  1. User john can only open one application and nothing else -- He don’t see no icon on the desktop or start menu, except for one or two applications which i want to allow. He can't Right click on the desktop, the task-bar icons are not shown, there is no folder options, etc...

  2. User marry can open a specific application and copy data to one folder on D drive.

  3. User Dan, have access to all drives but cannot install software, and so on...

So far ,I've found only the following solutions, but they all seems to miss one or more feature: Desktop restriction Software 1. Faronics WINSelect The application seems to answer most of our needs except one feature which is very important to us but seems to be missing from WINSelect, which is "restriction per profile". WINSelect only allow to set up restrictions which are applied system-wide. If I have multiple user accounts on the system and want to apply different restrictions for each user, I cant.

  1. Deskman (No Restriction per user)-> Same thing, no restriction per profile.

  2. Desktop Security Rx -> not relevant, No Win7 Support.

  3. The only software that I've found which is offering a restriction per profile is " 1st Security Agent ". but its GUI is very complicated and not very intuitive.

It's worth to mention that I'm not looking for "Internet Kiosk software" although they share some features with the one I need. All I need is a software (like http://www.faronics.com/standard/winselect/) that is offering a way to restrict Windows user interface.

So if anybody know an Hardening software which allows to set-up user restrictions on Windows systems, It will be a big, big, big help for me!

Thanks to you all

share|improve this question
    
Are these computers completely isolated (as in not on a shared network)? If not, have you taken a look at the native solution wich is Active Directory with Group Policies? –  pauska Jun 23 '11 at 11:49
    
Yes, the computers are completely isolated (stand alone), so i cant use active directory group policy. more over, there are too many restriction that i need to apply, so it is an particle to set it up manual (one by one). –  MosheH Jun 23 '11 at 11:58
    
Google around for "Windows kiosk software". –  gravyface Jun 23 '11 at 12:21
    
Hey, Windows kiosk software isnt intended to work on a stand Alone Desktops. and its settings are usually targeting computers that are connected to the internet. Thanks anyway –  MosheH Jun 23 '11 at 14:00
    
I Already have Active directory in my network, that is not the problem. as I mentioned, the computers are standalone computer (This is the requirement) and needs to be completely isolated from the network, so i can't/ Not allowed to use Active directory. I"m now checking the option to use "multiple local group policy" (techrepublic.com/blog/itdojo/…), but even if it will work it will be hard work to implement and not so easy to reverse. 10x –  user85669 Jun 25 '11 at 7:11

2 Answers 2

Try using Local Security Policy, available in Control Panel>Administrative tools>Local Security Policy. This allows you to manipulate the local user and computer policy and edit all the settings you require. If every computer has the same requirements then you can use the File>Export utility on the first computer you configure, copy the resulting policy on to a USB pen and then file>import on another computer. Realistically, though, you need a domain, this is a very inefficient way of managing your computers and Active directory is the easiest way to do it. Maybe take a look at a 6 month trial of Microsoft Small Business Server 2011 ( http://www.microsoft.com/sbs/en/us/try-it.aspx and http://support.microsoft.com/kb/948472 to extend the trial)? This will allow you to test the software and give you time to convince your management that they need it.

With regards to limiting users's access to individual programs that is pretty tricky to be honest, you will need to use Software Restriction Policies which are a pain to set up and will need to be done per user as you cannot set up groups that span across your computers without Active Directory. Here's a MS KB to do so: http://technet.microsoft.com/en-us/library/bb457006.aspx.

share|improve this answer

follow this link to the lgpo section

http://blogs.technet.com/b/fdcc/archive/2010/01/15/updated-lgpo-utility-sources.aspx

share|improve this answer
    
I don't understand What should I do with The "GPO utility sources"? –  MosheH Jun 23 '11 at 15:35
    
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Scott Pack Jul 18 '12 at 2:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.