Restrict Access to RegEdit?

  • Thread starter Thread starter Steve Harp
  • Start date Start date
S

Steve Harp

Hi All,

I'm using XP-Pro SP2 on all of my kid's computers. My son has learned
how to delete a registry key and disable CyberSitter hence gaining
access to all the sites I have blocked. How can I restrict his access
so he cannot run RegEdit?

Thanks,
Steve
 
First make sure he is not a local administrator else your efforts will be
futile. Of course any user with physical access to a computer and has the
skills, time, and determination can usually become and administrator which
is why it is suggested that you make sure the computer is configured to boot
only from the system hard drive, password protect cmos settings, and have a
locking computer case though even that is not foolproof.

In XP Pro you can edit Group Policy as an administrator to prevent access to
operating system registry editing tools. You can open local Group Policy via
gpedit.msc and go to user configuration/administrative templates/system to
see the options do disable registry editing, the command prompt, and others.
On a stand alone computer however restrictions will apply to all users
though you can reverse them as an administrator when you need access and
then enable them again. The free Microsoft Shared Computer Toolkit will
allow you to put many restrictions on specific user accounts.

Since you also have evidence of what you might consider malicious activity
you may want to take some sort of disciplinary action or warning of what
will happen if such activity continues. This is not a parenting forum so I
can not recommend anything specific but I know what I would do.

Steve

http://www.microsoft.com/windowsxp/sharedaccess/default.mspx -- Shared
Computer Toolkit
 
Steven L Umbach said:
First make sure he is not a local administrator else your efforts will be
futile. Of course any user with physical access to a computer and has the
skills, time, and determination can usually become and administrator which
is why it is suggested that you make sure the computer is configured to
boot only from the system hard drive, password protect cmos settings, and
have a locking computer case though even that is not foolproof.

In XP Pro you can edit Group Policy as an administrator to prevent access
to operating system registry editing tools. You can open local Group
Policy via gpedit.msc and go to user configuration/administrative
templates/system to see the options do disable registry editing, the
command prompt, and others. On a stand alone computer however restrictions
will apply to all users though you can reverse them as an administrator
when you need access and then enable them again. The free Microsoft Shared
Computer Toolkit will allow you to put many restrictions on specific user
accounts.

Since you also have evidence of what you might consider malicious activity
you may want to take some sort of disciplinary action or warning of what
will happen if such activity continues. This is not a parenting forum so I
can not recommend anything specific but I know what I would do.

Steve

http://www.microsoft.com/windowsxp/sharedaccess/default.mspx -- Shared
Computer Toolkit
Click to expand...
Would setting file permissions such that he does not have the right to run
regedit work (or be advisable in addition to what Steven said)?

However, if he is a member of the administrators group, there is no way to
keep him from doing what he wants when he wants to do it. Well as long as
the computer exists anyway.
Jim
 
In
Steve Harp said:
Hi All,

I'm using XP-Pro SP2 on all of my kid's computers. My son has learned
how to delete a registry key and disable CyberSitter hence gaining
access to all the sites I have blocked. How can I restrict his access
so he cannot run RegEdit?

Thanks,
Steve
Click to expand...

In addition to the other replies....

Take the computer access away if he won't abide by your rules. What would
you do if he drove your car without your permission? A computer is not a
birthright.
 
From: "Steve Harp" <[email protected]>

| Hi All,
|
| I'm using XP-Pro SP2 on all of my kid's computers. My son has learned
| how to delete a registry key and disable CyberSitter hence gaining
| access to all the sites I have blocked. How can I restrict his access
| so he cannot run RegEdit?
|
| Thanks,
| Steve

Local policies and use of a restricted access account.

Logon as the Kid.

In the Regedit; Goto...

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

And set the following..

DisableRegistryTools
DWORD 1
 
Jim yes you can use NTFS permissions to deny access to a folder or file BUT
you need to do that for every instance of the executables in question and
there is always the possibility that the user can create a copy in his user
profile or run from a flash drive. For situations where that is a concern
Software Restriction Policies in XP Pro and XP Home [only via Shared
Computer Toolkit] can be implemented.

Steve

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
--- Software Restriction Policies
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx --- Shared
Computer Toolkit
 
Back
Top