Hi choonks89,
Here is a way to use Limited User Accounts, the Registry, and SywareBlaster to block changes of the HomePage.
Let's talk briefly about
Limited User Accounts and
Administrator Accounts:
It is important to understand the distinction between "Limited User Accounts" and "Administrative Privilege Accounts". As a general rule, each machine should have only one "Administrator Account" and all other accounts should be "Limited User Accounts". This is important for a variety of reasons that I'll summarize. Limited User Accounts have the ability to use any application program that is installed on the machine; such as Microsoft Office, Outlook or other email client, Internet Explorer or other web browser, photo, music, and media display and editing applications, games, etc. The "limit" is that a "Limited User Account" cannot install new application programs, modify many areas of the Registry, or gain access to the Operating System, unless allowed by the Administrator. The "Administrator" account can do all the above, but can also install programs, modify the Registry, and gain access to changing the Operating System.
As a General Rule, all of us should be running our machine from a "Limited User Account" most of the time, and all of the time that we are logged onto the Internet. Why? Because, in the ordinary course of computer use, various hazards and risks occur. If the owner/user is running from a "limited User Account" any "damage incurred" will be limited by the overall privilege of the user account. So for instance, if an owner/user is "surfing the Internet" and runs afoul of some spyware, trojan or virus (by downloading or clicking) then the spyware/trojan/virus will be limited in its ability to "install itself" into the Registry and Operating System. A Limited User Account, can still get "infected", but the infection will be stopped from advancing in many cases, because the open User Account does not have privilege to modify the Registry or to change the Operating System. Therefore, the "malware" may get saved in Temporary Internet Files or remain attached to a downloaded song or picture, but will not be able to do its work of additionally embedding itself into the Registry or OS. Pretty Neat, huh? (greatly oversimplified, but still good stuff) If however, the owner/user is "surfing the Internet" while logged into the machine as Administrator, and then they run afoul of spyware/trojan/virus by downloading or click on infectious content, that malware will enjoy the same "privilege" to install itself into the Operating System or modify the Registry, activating its malicious function or payload. Not Good!
With regard to the school computers and potential prankster activity, making ONLY one Limited User Account available for all students to use, will restrict/protect against unwanted program installation (for instance attempts to install Limewire and Bit-Torrent type programs for P2P file/picture/song downloading, will not be possible. The Limited User Account “Student” will not be able to create new User Login Accounts. Many Registry changes will not be accessible to change, and the desired protection against changing IE homepage to porn sites can be blocked by adding the steps I’ve laid out for Registry change, below. But the Student Account will be able to use the Internet and any application programs installed on the machine by the Administrator.
Please note that this restriction on changing the homepage is strictly technical/local and not a matter of restricting/censoring information that the students can make available to themselves through browsing.
To “change” the attributes of a “user account” you have to be logged on from the Administrator account.
Go to Control Panel
Click on User Accounts
Select the “Student” account (or whatever login name the Students use)
If it is already a Limited User Account, leave it that way.
If it is an Administrator Account…
Click on “Change my Account Type
Select “Limited User Account”
If a “Guest” account exists, turn it off (optional)
Now select the Teacher/Administrator Account
Click on “Create a Password”
Create a “strong password” with both numbers and letters, preferably not easily guessed
Write down your Administrator Password and keep it on paper in two separate secure locations.
Now to the Registry Fix:
Please Note: If you/your Aunt is not familiar with using Regedit, then you/she may benefit from some study before making any changes.
(Note: Always back up the portion of the Registry you're going to work on, before you begin.)
Here's a link for an eBook regarding Registry:
http://newbieclub.com/rfncopy/?vic (bummer: it costs $29.95, but you gain access to their whole library and all you can download for a whole 12 months)
Here's a free (but brief) column about the Registry, written by a Microsoft MVP. It is straight-forward about risks and precautions you should take when working in the Registry.
It also has links for additional study and information.
http://www.microsoft.com/windowsxp/using/s…_03march17.mspx
The steps that I'm recommending here are "relatively" simple, have been used many times by others, and just to make sure, I performed all the recommended steps on my own Win98SE machine, and a WinXP Pro SP2 laptop that I have sitting around here. I got the correct results with no damage after continuous use of the machine for the past 4 days. Here, I am presuming that your Aunt's machines are running Win XP with SP2, so if not, we may have to study a little more. Please let us know.
There
IS a downside: I was able to Defeat my own protection settings! But to do so, I had to know exactly where to look in the Registry and what item/s to change. It is possible that some enterprising student will also be able to figure out how to get around my recommended change, but this "fix" should discourage most of the little pranksters.
This works with Microsoft Internet Explorer 5 and up and should work on all the
major Windows platforms. Personally, I tested it on Windows XP Pro and 98SE.
[If you have two (2) login accounts: (1) Student and (2) Administrator, perform the regedit while logged in as Student so that the Registry String HKEY_CURRENT_USER\ will make the change in the Student login.]
[[Temporarily give the Student Account "Administrative privilege" so you can make the Registry Changes, then go back and make Student Account a "Limited User Account", so the Student cannot easily change your settings]]
First…. close all Internet Explorer Windows.
Next click Start - Run - (type) regedit Click OK
Next, navigate to this key:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
In the right hand pane, right-click a blank area and choose New - DWORD value
Name it HomePage
Double click your new HomePage item, and assign it a Value data of 1
Exit the registry and then test the result by opening IE and trying to change your home page.
You should not be able to do so.
If you try to drag a page icon to the Home button, a circle with an X should appear indicating the move isn't possible.
If you click Tools - Internet Options - General (tab), you will see that the home page entry and associated buttons to make changes are greyed-out.
——————————————————-
Note: To re-enable the ability to change your home page, just change the same registry value from 1 to 0.
——————————————————
[Possible What-If’s]
If all the keys are not present under the Policies key you can create them.
For example if all you have is:
HKEY_CURRENT_USER\Software\Policies\
you would right click the Polices key and choose New Key and name it Microsoft
Then under Microsoft, you would create another key named Internet Explorer
and then under Internet Explorer, you would create a third key named Control Panel
so that if you copied the key name you would end up with:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
Then you would go ahead and create the Dword value
Any other “downsides” to this fix?
Maybe.
Some “poorly written application programs” may not run with all their features when run in the limited user account. This may provoke some complaints from students and additional work on the part of Administrator to set up these specific application programs to run the way students have become accustomed to. This shouldn’t actually be much extra work. You Aunt may actually use this “transition time” to select more “mainstream” application programs that have no problems when running in Limited User Account Login. (such problems for applications are not really very likely to occur)
The above “fix” is for Internet Explorer only. Your Aunt should consider using ONLY Internet Explorer, or if she decides to allow the use of others like Firefox/Opera, she will have to do additional registry work
Remember above, I mentioned that I am able to work-around this fix.
IF THIS FIX IS NOT “STRONG” ENOUGH FOR YOUR AUNTS SITUATION, I’M PUTTING LINKS TO ADDITIONAL FIXES AT THE BOTTOM OF THIS REPLY.
Now a word about risks of Malware encountered on the internet attempting to change the HomePage setting.
…. It can happen….. enough said.
The best solution to prevent Malware from changing the HomePage setting is to install SpywareBlaster and keep it updated about once weekly. Get it here: http://www.javacoolsoftware.com/spywareblaster.html
There are other utilities that will help protect your machines from accidentally running afoul of known Malware sites, but SpywareBlaster protects agains Homepage changes.
These well recommended tools include: IE-Spyad and MVPS Hosts file.
(While I use these two wonderful tools on my own machines, they are "off-topic" to your question.)
But if you want to get a quick glance at the hordes of "bad-guy sites" that should be blocked, go here:
http://www.mvps.org/winhelp2002/hosts.txt
OK, now you have your machines set so that a beginning level prankster won't be able to change the HomePage.
Additional settings and tweaks can make things more secure, but I want to get this posted to you.
You decide if this is enough, or if you believe you need additional security steps.
Here’s some additional resource information:
http://www.windowsecurity.com/articles/Enf…y-Settings.html
http://support.microsoft.com/?id=831787
For a very comprehensive look at what policies and restrictions are available when using WinXP Pro,
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx
Please keep us posted on your progress.
Best Regards
Doug
