I work in an organization that uses Faronics Deep Freeze to prevent users from making changes to the computer. I had always been under the impression that a standard user (a user who is only a member of the "Users" group) can't make any system-wide changes. The description for the group states:

Users are prevented from making accidental or intentional system-wide changes and can run most applications

The senior system administrators here tell me this isn't true in practice. What is an example of where this isn't true? Do standard users have any write permissions outside of %USERPROFILE% or HKCU?

  • 3
    There's weak spots in almost every system. HKCU is Hkey Current User, so it's normal for users to be able to modify that. There's also plenty of applications that do dirty things like have global config options and paths, that one users settings can 'spill over' on others. – Sobrique Apr 25 '14 at 19:40
  • 2
    Why don't you ask the fellow senior admin on what he meant? Also, "system wide changes" is a very wide term. Is changing the desktop wallpaper for every user a "system wide change"? Is it a big security nightmare? I think this question is very broad in it's current state – MichelZ Apr 25 '14 at 19:44
  • 1
    @MichelZ The admins here don't remember precisely because they've been relying on Deep Freeze for so long. Yes, changing the desktop wallpaper for all users is a system-wide change. Is that possible? – Jason Apr 25 '14 at 19:50
  • 1
    I don't know. That's what I'm saying... the question is very broad. There could be dozens of things a user can do which might be considered "system wide" – MichelZ Apr 25 '14 at 19:52
  • 3
    Is unplugging the computer a system-wide change? What about hitting it with a hammer? How about booting into a different operating system? Your question lacks clarity, and as such, is impossibly broad. – HopelessN00b Apr 25 '14 at 20:46

Yes, by default a standard user can get to a bunch of stuff. Most, if not all, of this can be fixed with policies, but I can absolutely understand why people end up using a deep freeze type solution and, indeed, non persistant images is a selling point of VDI solutions.

Depending on whether UAC is enabled users may be able to access and modify files on the local drives, install applications (though generally to their own profile), run viruses or malware etc etc.

To clarify, by default, the standard user is nowhere near secure enough for use in an environment where users need to be heavily controlled such as schools, public stations and so on.

Correct me if I'm wrong, but I didn't think Deep Freeze was about securing a particular session, but to prevent changes from sticking?

  • Yes, Deep Freeze is more about management (keeping the configuration static) than security. I'm still curious to see an example of something a standard user can do that effects other users. – Jason Apr 25 '14 at 20:21
  • 4
    Yet you've told us nothing about your environment. Why not fire up a vanilla station, log on as a user and have a play? I've given you some places to start. – Dan Apr 25 '14 at 20:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.