It would be nice if someone incorporated all of this knowledge into a "Terminal Services Application Security Best Practices" document. Is there anything out there like this? Who's not doing anything for the next week or so? -Joel ________________________________ From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Jeff Durbin Sent: Thursday, September 09, 2004 10:20 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Users installing programs Don't forget AppSec, from the ResKit. Using that combined with "Run only specified windows applications" virtually guarantees that you'll limit users to your app list. You still have to deal with IE security, though. ________________________________ From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Joel Stolk Sent: Thursday, September 09, 2004 6:49 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Users installing programs I don't believe this will be a problem, but if you do encouter issues, use RegMon to track down any registry permission problems. Then you can scale back on the security as needed. Another thing I forgot to mention that we do here is to restrict Internet Explorer's security settings (no ActiveX control downloading, Java permissions, etc.). You could also restrict the running of known problem executables at User Configuration\Administrative Templates\System\Don't Run Specified Windows Applications. We don't do this personally, but I imagine it would be helpful if you are running into the same apps being installed again and again. -Joel ________________________________ From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Abshire Sent: Thursday, September 09, 2004 8:30 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Users installing programs Thanks Joel but I checked and that policy is already in place, enabled. I'm thinking about looking into the HKLM read only and the Full Security mode that a couple of people have requested. My concerns are other programs such as Office and Adobe will not work. -----Original Message----- From: Joel Stolk [mailto:JStolk@xxxxxxxxxxxxxxxx] Sent: Wednesday, September 08, 2004 4:59 PM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Users installing programs The locations are: Computer Settings/Windows Components/Windows Installer/Policy Setting/Prohibit User Installs User Settings/Windows Components/Internet Explorer/Browser menus/Disable Save this program to disk These come from the out of box ADM templates that come with the GPMC with SP1 from Microsoft. If you need the GPMC go to http://www.microsoft.com/downloads/details.aspx?FamilyId=0A6D4C24-8CBD-4 B35-9272-DD3CBFC81887&displaylang=en -Joel ________________________________ From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Abshire Sent: Wednesday, September 08, 2004 4:46 PM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Users installing programs I have searched the GPO but cannot find either of these policies, is there a specific .adm I need to load? -----Original Message----- From: Joel Stolk [mailto:JStolk@xxxxxxxxxxxxxxxx] Sent: Wednesday, September 08, 2004 4:43 PM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Users installing programs One quick tip I can think of is to change the permissions in the registry on the HKLM\Software key to read only for the users. A lot of program installs will fail and/or not execute if they cannot write information to this key. Also, a GPO or local policy to Prohibit User Installs (under Computer Configuration) could help. Additionally, use a GPO or local policy to not allow downloads from Internet Explorer. -Joel ________________________________ From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Abshire Sent: Wednesday, September 08, 2004 2:54 PM To: thin@xxxxxxxxxxxxx Subject: [THIN] Users installing programs I have a question, I work for a property management company and we provide Internet via Citrix to students. I have tried desperately to lock down the servers but they seem to still be able to install Internet based programs, (e.g. AOL instant messenger, Poker Party, etc) to name a few. Is there a way to lock the server down tight so this cannot continue without prohibiting the users to run necessary programs such as Office? Jim Abshire Network Administrator Dinerstein Management 713-570-0373 ++++++CONFIDENTIALITY NOTICE++++++ The information in this email may be confidential and/or privileged. This email is intended to be reviewed by only the individual or organization named above. If you are not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any review, dissemination or copying of this email and its attachments, if any, or the information contained herein is prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system. ++++++CONFIDENTIALITY NOTICE++++++ The information in this email may be confidential and/or privileged. This email is intended to be reviewed by only the individual or organization named above. If you are not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any review, dissemination or copying of this email and its attachments, if any, or the information contained herein is prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system. ++++++CONFIDENTIALITY NOTICE++++++ The information in this email may be confidential and/or privileged. This email is intended to be reviewed by only the individual or organization named above. If you are not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any review, dissemination or copying of this email and its attachments, if any, or the information contained herein is prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system. ++++++CONFIDENTIALITY NOTICE++++++ The information in this email may be confidential and/or privileged. This email is intended to be reviewed by only the individual or organization named above. If you are not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any review, dissemination or copying of this email and its attachments, if any, or the information contained herein is prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system.