NT Policy Editor Problems

[Sphinxdra]

I've enabled a series of programs in the policy editor to restrict
students from running programs they shouldn't on the workstations I've
set up in my lab. The problem is some programs don't run. I've two DOS
compilers that I've enabled (Borland Turbo C++ and Borland Turbo Pascal)
and when I log on with student account and I try to run them I get the
error I would receive if the program wasn't enabled. My second problem
is when I try to run certain Windows programs a dialog box comes up
asking for, what I want to connect to the program as, and a password. As
if the program I want to access is on another computer in which I
haven't direct access to.

------------------
Ultimate Cyber Geek

[capri]

You obvioulsy know more than I do, but after attempting to impose some restrictions with policy editor, I found I had to remove my restrictions as they interefered with other programs. Ex. by removing the DOS prompt..no DOS based programs would run..even though there were shortcuts in place for them.

Microsoft is not totally clear on how the policies work. It looks like whatever you have set in place is interfering with the programs you are trying to run. Not sure how complex they are..but if possible why not remove one layer at a time..until you can locate where the conflict is. It really comes down to which is worse..restricting the users from using a useful app..or trusting them not to do any damage by giving them access to things they shouldn't have.

[JackLothian]

We use such restrictions in our lab & I don't think suppressing the DOS prompt also stops all DOS from running (We set this & our DOS programs run). I may be mistaken but I thought there was a separate restriction for shutting down all DOS (This we do not set.)

To allow a DOS program to run can be quite complicated. You see to run the short-cut on the desktop means the PIF it uses must be specified & this shortcut calls a BAT file that must also be specified and finally this BAT calls a program that must also be specified. Thus 3 separate files must be entered into the allow to run list. We are successfully doing this with with 4 or 5 DOS apps. (Although our clients are WIN95 - the policies should be the same for NT clients.)

As to trust. It depends on the age of the students & their general attitude to school. We have a Junior High & anything that is not locked into the desktop is fair game. If we don't lock it tight we spend endless our undoing the damage. If you have a class of senior high students & they are all keen to learn programming you will have minimal problems with invasions & damage to your system.

[palma]

As for this program not running. It could be very simple, we are running the same setup. What might be happening is that the program might be calling another problem outside the 'programs' you have setup. I would be checking this out.

We have found this a few times before. Its just trial and error.

[AB_IRL]

I don't know if this is any help to you but when I was listing the programs that could run in my policy, they often refused to start. What I ended up doing is to go in as a user that has full access, then open the Task Manager and go to Processes. Take note of all the processes that are running and then kick off your application. As the application is starting up and running look for any new processes that are aded to the list. Then add them to the list of programs that are allowed to run in your policy.
When I logged in as the restricted user I found that all my applications run now and there are no more error messages.
I hope this is of some help.

------------------