Office Computers Going on LOCKDOWN! Software Advise?

[ericbramlett]

Alright, after fixing our office computers the 500th time b/c one of our agents either installed something or changed the settings on something, I've decided it's time to LOCK DOWN THE SYSTEMS! I want to be able to:
1) Prohibit/Allow access to specific programs
2) Prohibit users from installing software
3) Prohibit users from changing settings

Any advise? I've played around with the user settings on XP Home (what we're running) & it doesn't seem to let me do what I want. Amy I missing something there, or will I need new software?

Thanks!

[drewnick]

At my university, we had Novell Netware and it had an excellent lockdown on Windows XP Pro - plus the netware features. I believe it is costly, though. So is your time.

[Calgary Agent]

Sorry Eric .... . XP home doesn't allow Admin settings (as does XP Pro) which would limit regular users from doing what you want. Anyone who logs on to a Home Edition machine has full control.

[Ryan Ward]

Can't you make them log on as specific users without admin priveleges?

[Ryan Ward]

Go to control panel, click on user accounts and set their access to limited. I think that should work.

[jbferris]

and buy Macs next time.

[RonnieG]

Eric,

Install XP Pro. XP Home just does not have the wealth security features you need in an office environment, especially if anything is networked. I run XP Pro on every machine, personal and office, including laptops, for that very reason.

You also must have good backups. For shared machines, I have a disk image backup that can be restored to return the machine to its original "virgin" installed state, with all OS and applications freshly installed and user IDs setup, but no one has logged on yet. Then I have weekly full backups and a week's worth of daily incremental backups to restore it to whatever date I need to in the last week. All backups go to a separate external disk drive on my main server. When I do the disk image backups, I move the external drive to the machine I am backing up to speed up the process. All other backups are done on an automated schedule between midnight and 7 AM, with the external disk drive being used as a shared network resource, accessible only to my user ID and password, which is setup in the automated backup scheduler. Everything is done with standard XP Pro software, except the disk image backup, which is an off-the-shelf retail backup package called "NTI Backup". There are several similar backup packages available. The external disk drive is also where everyone stores their personal files, under protected personal folders, so they can be accessed from any machine on the network.

I used to sell, install and manage large Novell networks in a past life, so all of these things are taken from that experience. I have restored / rebuilt so many machines due to user foul ups than I want to count. Having a strong, well protected network environment, a separate shared disk drive, and good backup procedures and policies is the key.

[cgmckeever]

you can try DEEPFREEZE which locks the machine and resets it to a baseline at reboot OR switch to thin clients and windows 2003 - this reduces adminsitration overhead 10 fold

[pcdoc]

Any advise?

With nine offices in a hundred mile radius, I had a terrible problem policing computer use.

Finally, with advice from both legal counsel and the state labor board, I had one of my subordinates pen a computer usage manual. We went back and forth over several months, refining, adding, deleting various items concerning what was allowable and proper use. Since my business required the utmost in guarding the integrity of customer data, security was a main concern.

Much of what you are experiencing can be eliminated with the threat of termination.

I fired a person (on the spot, no notice, clean out your d**m desk) for using IM in direct contravention of policy. The employee appealed to the Department of Labor. Because my computer policies had been pre-approved, the board sided with my company.

[coastal]

Make your users buy their own computers.

The only computers in our office that were paid for by the brokerage are the receptionists.