Win XP restrictions (guest account options)

I have Windows XP Pro installed on my computer, I just activated the guest account and I'd like to know if it is possible to restrict the guest account from using some programs, and if it would be possible by way of options or scripts to display a message when you log on to guest account that says that "you have to save your documents on diskettes, because they will be deleted at log off" and I want to know if it is possible to make this option work or script to make the documents delete. If so what do I need to do? (Running under FAT32 -> will change if need be, I know how to do it). If possible, for the rest, I would need some guidance.

Thanks in advance for any response you may give me.
Sincerely,
Steve Demers

Look into using Software Restriction Policies, here are some good links:

http://www.jsiinc.com/SUBJ/tip4500/rh4519.htm
http://www.microsoft.com/technet/pro.../rstrplcy.mspx
http://support.microsoft.com/default...b;en-us;324036

Hi there Irongeek, I'm actually taking a look at the info you gave me (understand that I'm quite a newbie at this stuff) the help is very much appreciated. Do you mean that all of what I've asked for can be done within the gpedit.msc ?? If so, thanks a lot, and if I need help with some of the options there may I ask for some more help?
---------
[edit]
sorry I forgot to ask do I need to change my FAT32 to NTFS?
[/edit]

Thanks in advance for any response you may give me.
Sincerely,
Steve Demers

The message part will have to be done a little different. Just post any other questions you have in this thread.

It's a good idea to use NTFS for other reasons, but I'm pretty sure Software Restriction Policies will work fine on a Fat32 drive.

Couldn't you make a batch file to do a netsend to that computer? You can make the batch file and put it in the start up folder or somethign... I don't know, it's just an idea for a poor man's way of doing what he wanted with the message part lol.

Yep, you could do a netsend command but some institutions (like my university) disable the messenger service because they keep getting “netsend spam” for penis enlargement services. :)

You can send a message to the guest account through the task manager also.
Microsoft technet has a large script repository with sample scripts. If you take a look you should get some inspiration from them.

http://www.microsoft.com/technet/scr...r/default.mspx

For the login message.. Just create and assign a login script to the guest account that displays text that is echoed from a batch file. Just put a pause at the end of the batch file and the screen will sit there until a key is pressed. No need to use netsend or anything like that.

As far as using fat32 or NTFS. If you are going to restrict write/read access on the system you will have to use NTFS as you do not have any type of security restrictions in FAT32. Then you just need to setup your file system permissions correctly so that the account only has write access to a limited number of directories. Then you can use a logoff script that will delete everything that is in those directories.

Hi there mohaughn, thanks for the info you have given me, I would like to do what you proposed, but since I am new at this I don't exactly know (what is) or how to do a batch file. Sorry about that, could you or anyone please explain me what it is and how to do one?

Thanks in advance for any help you might give me.
Sincerely,
Steve Demers

Googling for GPO login scripts and just login scripts returns the following sites. You will have to modify what they have to get what you need, but this will give you the idea...

http://www.petri.co.il/tools.htm
http://www.serverwatch.com/tutorials...le.php/1474241


your script will be extremely simple.. basically you will put this-


echo off
echo "This is what you want to pop up on the screen."
pause


Login scripts are assigned on the Profile tab of a user account in active directory(users and computers) and local users(computer management for a local account). You can also apply a group policy object that will run a login script for all users that you assign. I would recommend going and getting yourself a good WinXP and AD book, and read up on group policy objects and login scripts as both topics are a bit to large to properly cover in this forum.

Try right clicking on the drive, then selecting "sharing and security", that might help

Quote:

---

Try right clicking on the drive, then selecting "sharing and security", that might help

---

He can't, not fully at least, because his system is on FAT32. You see, here are the differences:

http://www.theeldergeek.com/ntfs_or_...ile_system.htm
http://www.microsoft.com/windowsxp/u...october01.mspx
http://www.spcug.org/reviews/bl0401.htm


NTFS is much faster in regards to file handling and offers a much greater level of security to folders and files. You can restrict entire folders from a certain user or group, or grant access to only one user or group. Either way, NTFS is going to be the root of not only increasing system preformance but also giving a 'simple' way to control what the guest account can and can not access.

For FAT32 to NTFS conversion:

http://www.microsoft.com/technet/pro...onvertfat.mspx

It may look prettier if you use a .VBS (Visual Basic Script) file instead of a Batch file to do the message part.
Code for Message.vbs:

Code:

---

msgbox "This is your Message" & vbcrlf & "This is the 2nd line"

---

Thanks a lot for all the information on the subject you guys, it helped me a lot :)

Sincerely,
Steve Demers

*Cough*

Guys and gals.... We got him as far as gpedit.msc so why don't we show him how to use it? ;)

Under Computer Configuration - Windows Settings - Security Settings - Local policies - Security Options you will find two settings:-

1. Interactive Logon: Message text for users attempting to log on
2. Interactive Logon: Message title for users attempting to log on

They do what they say.... They produce a large grey box before the login prompt with the title you put in the second key, (for example "***** WARNING *****"), and the text you wrote in the first key, (for example: "If you are logging into this computer under the GUEST account please have a virus free floppy disk available to save your work. As a Guest you do not have rights to save any files to this computer so your work will be lost if you do not save it to the floppy before exiting. Thank you and enjoy your experience.").

As a side note this is also a useful thing to use for such things as Terminal services machines that are publicly available. You can display the warning you want every time someone hit's the login prompt and, as a side benefit it's an extra step an attacker has to go through if he tries a brute force attack on a login name..... Nothing special but his tool won't work unless it accounts for the addidional input and it slows down his transaction rate.... :D

There... all rather simple really..... ;)

[Edit]

Steve, I would caution against signing your real name at the bottom of your posts. It may not bother you today but it may in 2 years time and this stuff won't go away.

You never know who comes here no what their intent may be - that may bite you in the future......

[/Edit]