Locking down NT

You need to implement system policies. You can use the Policy Editor, found on the NT cd, to set up a maximum security lockdown of NT. It is highly configurable and you can remove most desktop, start menu, and control panel items. You can also specify the Windows applications that are allowed. Your policies can be stored in the login directory on the Netware server to be downloaded to each system when they log into the network. See Microsoft's article Q161334 and the subsequent articles onPolicy and Profiles.
- Steve

Hi, in addition to what respondent #1 said:
save policies in %systemroot%\system32\repl\import\scripts\ntconfig.pol (this places it in netlogon); replicate to all bdcs on the network. System policies have a search order: If wkstn finds a .pol file it first searches for a user policy specific to the user logged on. If it finds a user policy it applies the registry settings to that wkstn's HKEY_CURRENT_USER subtree. If the user has a specific policy, the wkstn. won't look for group policies. If no policy for user, wkstn looks for .pol file for default user and applies it, if exists. Then, wkstn. looks for.pol for group policies to which the user may belong.. When you create group policies, you must assign a priority number and policies are applied in reverse order from lowest priority groups and overlaying higher-priority group settings. Thus, higher-priority settings take precedence. Thus, plan your policies first and decide if there will be any exceptions to a default user profile.

Thanks guys, but NT Policies will only help me secure the workstations.

They're looking for more, they want the application to launch when the user logs in, they want the user to be logged out when the application is closed.
As far as restricting access to their icons, and start menu, programs, etc - that's easy.

I need a little automation here.

how about executing a logon script to launch the app? write a simple batch file, put it in %systemroot%\system32\repl\import\scripts (AKA NETLOGON) and use the user manager to have that user execute the logon script. Don't know if you can get it to logon to the emulator, but it will start the app.

Yes, but how would they be automatically logged out if they close the emulator?

If you have the funds, a software like Full Armor should do the trick. I use it and I only let the users have access to programs or files that they need and nothing else. I don't know if it will logoff for you but, I think you can download an eval copy at www.fullarmor.com.

Hope this helps
Bra-k

I have to wait for a sales rep to email me back before I can get an eval of Full Armor, in the meantime I'll keep the thread open, so if anyone else has a possible solution, please post a reply. Thank you.

one of the policies is run custom shell, you can use this to replace the "normal" NT desktop, I've done this with I.E which works very well, it may be worth giving this ago with your emulator, as for login off when the app quits, not sure there's a NT tool that does this, but maybe a third party app that could monitor main app in the background, and then perform a shutdown (shutdown.exe off res kit)Good luck. p.s you can also lock down system to only run one app, but doesn't get rid of start menu, you still get help and program menu. cya

As you already use Netware, why not use ZenWorks starter pack 2 (which is a free download). You could maximize policies in NT and only allow Nal.exe to run. Within Zen, you can force run the app and reboot after completion. The users would have no control over this. This would only allow the users to run your emulator.. Zen also allows a script to be run after the app, you can add a reboot.exe command or a shutdown script or a logout command. I have a freeware utility for ya but you should be able to write a simple reboot script or use the features already in Zenworks. If you aren't real familiar with Zenworks, the Administrators Guide is fairly cheap, ISBN 0-7645-4561-2 I got it for around ?20

Hope this helps... Ron, GolfKingUK@aol.com

OK, so you know how to disable icons and such.. Now as to how to login/logout:

Create a batch file for the program that looks like this:

net login username password
start emulatorapplication.exe
{wait until application is closed}
net logoutusername

This may be a waste of space now that I think about it, but you will definately need some batch method there that waits until the program is closed before proceding with the logout...

I believe you can do this through a Macro Scripting tool. Using this tool you can automatically start the application once the user logs in and wait till the application window is closed and then execute a logout script.

There are several toolsthat can do this for you and many of them have readily available downloadable evaluation versions.

Check the following ones :

Automate
Macro Express

You can get a free evaluation copy from :

http://tucows.com
http://download.com

hope this helps you out...

-Rafik.