Page 1 of 2 12 LastLast
Results 1 to 15 of 30
  1. #1
    4 Star Lounger
    Join Date
    Jul 2012
    Posts
    417
    Thanks
    238
    Thanked 27 Times in 26 Posts

    How to stop users downloading programs?

    I volunteer at a non-profit organization to help them keep their computers safe & well maintained
    They have grown from 2 98SE's to 6 computers: 2 XP's & 2 Vista's
    Each computer user has an administrator account

    It's come to a point of a number of programs are being downloaded by whomever depending on whatever
    Yesterday one of their computers had PC Optimizer Pro, Search Protect by Conduit, Sweet Packs Updater Service and multiple other programs
    --- One of my questions is if I create only Limited accounts for each one of the computers, will those computer users be able to download programs?
    --- Another question is: what are some good alternatives to stop someone from just downloading anything they want?
    --- It's pretty bad when people download dangerous programs and then don't even want to understand the inherent dangers unless something seriously goes wrong but even then don't think it's their fault
    --- Now I know this has to be addressed from the top down which is what I will be doing

  2. #2
    Silver Lounger
    Join Date
    Oct 2012
    Posts
    2,146
    Thanks
    12
    Thanked 248 Times in 241 Posts
    When it comes to "community" computers, I always think of programs like DeepFreeze, Returnil, even SteadyState for the XP systems. Probably not compatible with the two elders though, but whatever they install or whatever trouble they run into, reboot and all that junk is gone.

    Works best if the data is on a server or separate drive (partition) so the system partition can be protected without further consideration, otherwise one needs to work out data saving protocols so it isn't erased with a reboot as well. Also of course, if one actually wants to make a change or install something that is permanent, somebody has to be responsible for that.

  3. The Following User Says Thank You to F.U.N. downtown For This Useful Post:

    cmptrgy (2013-07-20)

  4. #3
    Super Moderator RetiredGeek's Avatar
    Join Date
    Mar 2004
    Location
    Manning, South Carolina
    Posts
    6,474
    Thanks
    211
    Thanked 848 Times in 780 Posts
    Cmptrgy,

    When I used to maintain the computers for the local animal shelter I had the same problem. What I did was to use only Non-Administrator accounts, even hiding the Admin account so it didn't show up on the logon screen. I also used the Hosts file to keep the employees off of Facebook and similar sites. Then I got into psychological warfare telling them that every site they visited would be logged and the logs reviewed on a regular basis. A fabrication for sure but you'd be surprised how effective it was.

    Another tactic, which I and many others here use for other reasons, is to create a separate partition for the Operating System/Programs and Data directories. Then you can take separate images of each using a program like Macrium Reflect Free. Now when things get fouled up you just restore the Operating System/Programs partition to your known good state and you're read to rock. Regular backup procedures need only consider the Data partition including the System/Programs directory when you make an authorized change and/or for Windows and Program Updates. HTH
    May the Forces of good computing be with you!

    RG

    VBA Rules!

    My Systems: Desktop Specs
    Laptop Specs


  5. The Following User Says Thank You to RetiredGeek For This Useful Post:

    cmptrgy (2013-07-20)

  6. #4
    4 Star Lounger
    Join Date
    Jul 2012
    Posts
    417
    Thanks
    238
    Thanked 27 Times in 26 Posts
    Thank you for your inputs. Yes responsibility & manageability are definitely important here and I plan on seeing that through

  7. #5
    Lounge VIP bobprimak's Avatar
    Join Date
    Feb 2009
    Location
    Hinsdale, IL, USA
    Posts
    2,329
    Thanks
    140
    Thanked 117 Times in 100 Posts
    Quote Originally Posted by cmptrgy View Post
    I volunteer at a non-profit organization to help them keep their computers safe & well maintained
    They have grown from 2 98SE's to 6 computers: 2 XP's & 2 Vista's
    Each computer user has an administrator account

    It's come to a point of a number of programs are being downloaded by whomever depending on whatever
    Yesterday one of their computers had PC Optimizer Pro, Search Protect by Conduit, Sweet Packs Updater Service and multiple other programs
    --- One of my questions is if I create only Limited accounts for each one of the computers, will those computer users be able to download programs?
    --- Another question is: what are some good alternatives to stop someone from just downloading anything they want?
    --- It's pretty bad when people download dangerous programs and then don't even want to understand the inherent dangers unless something seriously goes wrong but even then don't think it's their fault
    --- Now I know this has to be addressed from the top down which is what I will be doing
    Without blocking all Internet Access, or disabling browsers entirely, no version of Windows has the built-in ability to prevent downloading stuff from the Internet.

    The best you can do in shared environments is to continuously back up data (even using syncing programs if frequent backups are needed) and use a program like Deep Freeze to restore the hard drive to its pre-use condition at the end of each session or at the end of each day of use.

    Windows 98 is no longer supported and should not be used on the Internet in any event. It's really insecure and has many unpatched vulnerabilities which are being exploited now.
    -- Bob Primak --

  8. #6
    New Lounger
    Join Date
    Jul 2013
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Ubuntu Linux to the rescue...

    I'm a volunteer tech at a local homeless shelter. For the ten Windows machines that are used for an after school program, I too use Deep Freeze with much success.

    For the residents, I tried donated Windows machines, but even with the Administrator account password protected and the Guest account enabled, they each barely lasted a week. All the usual toolbar add-on junk, downloads, gambling sites, porn, etc. just trashed them. Also, a few wise guys booted into setup and tried to change things there and one even did a total restore. So I enabled a password in the BIOS to stop that.

    So for those public machines, I installed Ubuntu Linux, a free download and password protected the Administrator account and enabled the Guest account. No more download problems! Everyone can get online, and also use the included Libre Office to type letters and correspondence, but as a Guest you can't install anything. I disabled the sound function in the BIOS as some residents were plugging headphones into the machine to listen to youtube videos for hours, hogging the access and leading to a few fist fights. I also took the machines off desks, and installed them on a counter, no seats, so they have to stand up to use them. This too limits the hogging.

    I periodically log in as administrator to check for and install any updates, the log back out and make the Guest account available.

    Ubuntu - worth a look for those public situations where you want more control.

    Gib Macs


  9. #7
    Super Moderator
    Join Date
    Jun 2011
    Location
    New England
    Posts
    2,911
    Thanks
    91
    Thanked 355 Times in 319 Posts
    Quote Originally Posted by bobprimak View Post
    Without blocking all Internet Access, or disabling browsers entirely, no version of Windows has the built-in ability to prevent downloading stuff from the Internet.
    Standard users can't install most programs, and most versions of Windows can disable all installations via Group Policy Editor: How to prevent users from installing programs

    It's also possible to prevent file downloads with Internet Explorer: Group Policy Setting of the Week 18 – Allow file download (Internet Explorer)

    And there are quite a few reasonably-priced programs which can be used to block the download of any executable program with any browser, e.g. Folder Guard

    Bruce

  10. The Following User Says Thank You to BruceR For This Useful Post:

    bobprimak (2013-07-25)

  11. #8
    Lounge VIP bobprimak's Avatar
    Join Date
    Feb 2009
    Location
    Hinsdale, IL, USA
    Posts
    2,329
    Thanks
    140
    Thanked 117 Times in 100 Posts
    BruceR, those options are very useful. I hadn't known that there was so much specific control possible through Group Policies.

    But I wonder about Group Policies in the OP's Windows 98 SE machines. That version doesn't have the Snap-In.

    Also, I believe some of the items in the OP's list are not installed Programs, so a Limited or Standard User could possibly download them and run them. PC Optimizer in particular can alter many parts of Windows and cause damages from a Standard User Account.

    The Windows XP machines would benefit from Group Policies and/or third-party solutions as you mention.
    Last edited by bobprimak; 2013-07-25 at 23:56.
    -- Bob Primak --

  12. #9
    4 Star Lounger
    Join Date
    Jul 2012
    Posts
    417
    Thanks
    238
    Thanked 27 Times in 26 Posts
    Thanks everyone for all of your excellent ideas. I am going to sort through them & use what I can handle.
    On the XP computers, I'm trying to get the organization to replace them with Winows 8 because Microsoft discontinues XP support in April 2014 and I'd like to see them operate in the modern world, but that remains to be seen.
    --- I mistakenly wrote "They have grown from 2 98SE's to 6 computers: 2 XP's & 2 Vista's"
    --- It should have been "They have grown from 2 98SE's to 6 computers: 4 XP's & 2 Vista's"
    Additionally I'd like to mention that usually I get to their office during Patch Tuesday week and ensure everything is up-to-date and the computers are operating properly and the computer users knew they better not have anything funny on their computers. But recently I wasn't able to come around for the last 3 months and it sure showed.
    --- I'm not a professional computer person as I am just a cmptrgy but I'm glad I can manage to keep their computers safe and well maintained and tips & ideas from WindowsSecrets help me a lot

  13. #10
    4 Star Lounger
    Join Date
    Dec 2009
    Location
    Hillsborough (San Francisco Bay area), California, USA
    Posts
    596
    Thanks
    5
    Thanked 61 Times in 60 Posts
    ??Should he go Win 8 or Win 7??? Open for discussion.

    Zig

  14. #11
    5 Star Lounger RussB's Avatar
    Join Date
    Dec 2009
    Location
    Grand Rapids, Michigan
    Posts
    678
    Thanks
    8
    Thanked 38 Times in 37 Posts
    The hardware may not be up to Win 7 or Win 8. Depending on what the computers are used for a version of Linux may be more in line with the older hardware.
    Do you "Believe"? Do you vote? Please Read:
    LEARN something today so you can TEACH something tomorrow.
    DETAIL in your question promotes DETAIL in my answer.
    Dominus Vobiscum <))>(

  15. #12
    Super Moderator
    Join Date
    Jun 2011
    Location
    New England
    Posts
    2,911
    Thanks
    91
    Thanked 355 Times in 319 Posts
    Quote Originally Posted by bobprimak View Post
    But I wonder about Group Policies in the OP's Windows 98 SE machines. That version doesn't have the Snap-In.
    It was confusing, but it turns out he isn't using 98.


    Quote Originally Posted by bobprimak View Post
    Also, I believe some of the items in the OP's list are not installed Programs, so a Limited or Standard User could possibly download them and run them. PC Optimizer in particular can alter many parts of Windows and cause damages from a Standard User Account.
    What makes you think PC Optimizer or the other two named programs don't have to be installed?


    Bruce

  16. #13
    4 Star Lounger
    Join Date
    Jul 2012
    Posts
    417
    Thanks
    238
    Thanked 27 Times in 26 Posts
    On the plan to update the computers: I'm pushing for Windows 8 64-bit withall the way without looking back with whatever peripherals and software are needed. The organization subscribes to TechSoup and I believe they can get very good discounts which be helpful to then - I also want to look into a server if I can figure out how to implement one in their system

  17. #14
    Silver Lounger
    Join Date
    Oct 2012
    Posts
    2,146
    Thanks
    12
    Thanked 248 Times in 241 Posts
    Unless there are more complex business needs, 4-10 seat data requirements are usually serviced quite nicely by a NAS, simplifying both backup and workstation maintenance. you can even handle that remotely on a more frequent basis (two weeks maybe), with TeamViewer, though they may not let you manage 6 systems initially with the free version. Since you are a volunteer you qualify to use it but 6 PCs on one account would probably trigger the automatic retail use flag and you'd need to explain your particulars to them.

  18. The Following User Says Thank You to F.U.N. downtown For This Useful Post:

    cmptrgy (2013-07-26)

  19. #15
    Lounge VIP bobprimak's Avatar
    Join Date
    Feb 2009
    Location
    Hinsdale, IL, USA
    Posts
    2,329
    Thanks
    140
    Thanked 117 Times in 100 Posts
    Quote Originally Posted by BruceR View Post
    It was confusing, but it turns out he isn't using 98.



    What makes you think PC Optimizer or the other two named programs don't have to be installed?


    Bruce
    The Win 98 point is indeed moot now.

    PC Optimizer is a web-based scan. It may have locally installed components, or not. I don't remember exactly how this service operates. But if it is only web based with maybe a small local app for the actual scan, yes it can make changes without being installed onto the local computer.

    In any event, I believe that PC Optimizer is happy to be run and to do its damages from a Limited User Account.
    -- Bob Primak --

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •