Sign in with
Sign up | Sign in
Your question

Lockdown Software

Last response: in Applications
Share
January 8, 2005 10:51:22 PM

We're looking at a couple software packages to further lock down our workstations at work. We're looking at <A HREF="http://www.appsense.net/default.asp?bhcp=1" target="_new">AppSense</A>, <A HREF="http://www.scriptlogic.com/eng/products/scriptlogic/mai..." target="_new">ScriptLogic</A>, and <A HREF="http://www.wyse.com/products/software/alcatraz.htm" target="_new">Alcatraz</A>. We were looking at Websense CRM as well, since we use their filtering software, but it's way too expensive. I was wondering if anyone has experience with these and would recommend one over another. We're currently leaning towards AppSense.

Jarrett

More about : lockdown software

January 9, 2005 2:41:50 AM

Are you using a windows domain? An updated win2k active directory group policy or a win2k3 group policy should provide plenty of lockdown. I read a little about AppSense on their website and it looks like it does just about exactly what active directory does already. Why add 3rd party software to do what windows can do already?

<A HREF="http://www.folken.net/myrig.htm" target="_new">My precious...</A>
January 10, 2005 12:01:44 AM

you can also use the MMC control console to lock it down, it comes builtin with Windows.

"Never underestimate the predictability of Stupidity."
<A HREF="http://www.cameronwilliamson.com" target="_new">-={Psychotic Sociopath.}=-</A>
<font color=blue>R.I.P. O.D.B.</font color=blue>
Related resources
January 10, 2005 12:31:15 AM

yep gotta love MMC when youre sysad, lol.

"Never underestimate the predictability of Stupidity."
<A HREF="http://www.cameronwilliamson.com" target="_new">-={Psychotic Sociopath.}=-</A>
<font color=blue>R.I.P. O.D.B.</font color=blue>
January 13, 2005 9:12:29 PM

Haven't really delved too deep into (In)Active Directory Group Policies. I suppose it's a solution, but we would need to overhaul our network. Right now everyone authenticates local for application reasons. MMC would probably work as well, it's just a matter of taking the time to go through it so that everyone can do what they need to do. We already have a couple apps that need a registry mod in XP to work in other than Admin accounts (luckily only a few laptops) and everything else runs under Win2K in PU accounts. We're hoping not only to stop user installs of stuff like screensavers, but also stop drive-by installs of ad/spyware. With everything else like a new ERP rollout about to happen, we just can't afford much time.

Jarrett
January 13, 2005 9:38:07 PM

All of that stuff is a piece of cake in GPOs. Just make a group policy on your domain user's organizational unit and mess with it :)  DO NOT EDIT THE DEFAULT DOMAIN POLICY!!!!
Always move your users and computers into their own OU and make a group policy there. All the options in the group policies are very well described so you will know exactly what it does.
Disabling users ability to install anything only takes a couple clicks :) 

<A HREF="http://www.folken.net/myrig.htm" target="_new">My precious...</A>
January 14, 2005 10:36:46 PM

Thanks. I'll play with it, and mention it to the boss. He may like the price a bit better. :lol: 

Jarrett
!