mshroyer's questions

I'm at a site where user accounts are limited to running only certain programs (according to file name), through the Windows XP RestrictRun policy mechanism. I realize this is largely useless as a security mechanism, but it is what it is.

Occasionally we'll run into a situation where something under a user account triggers the usual error message: "This operation has been cancelled due to restrictions in effect on this computer", but running the same program under a unrestricted account doesn't give any insight into what program was trying to be launched.

In the interest of troubleshooting this type of scenario, is there a way to get Windows to log program names blocked by a user's RestrictRun policy, or to show the name of the program blocked when displaying the above error message?

Is there a good way to automate installing local startup (rather than login) scripts in Windows XP and Windows 7, via the command line, WMI, COM, or otherwise (even Win32 if it comes to that)?

I need to setup a local startup script on a large number of computers, and unfortunately, Active Directory is absolutely not an option. I would like to write a script or small program that I can run on each computer to perform the startup script installation in order to save myself a lot of error-prone point-and-click manual labor.

I see that when one uses gpedit.msc to create a local startup script, information about the script gets stored in the registry here:

HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup

However, if you create such a script and then delete its registry key, the script will remain listed in the local Group Policy editor; as is so often the case in Windows, apparently there is more going on there than meets the eye. This leads me to question whether it's safe to manually add subkeys for new startup scripts here (I wouldn't want my script to be overwritten by later changes made using the local Group Policy editor, for instance)...

Another option that's occurred to me is to create an item in the Task Scheduler configured to run at system startup. However, my concerns there are twofold:

1. Can this be automated any more easily? For instance, the at command doesn't appear to let you schedule a task for system startup, and WMI's Win32_ScheduledJob interface looks unreliable (it fails to show any of my currently scheduled tasks, for one thing).

2. Would I be able to prevent users from logging in until the scheduled startup task is completed, as can be done with "normal" Windows startup scripts?

Thanks in advance for any suggestions, I've been banging my head against this one for a bit...

I'm trying to provide machines on a small LAN with read-only, anonymous access to files shared from a Windows 7 workstation (let's call it WIN7SVR). In particular, I don't want clients to have to deal with a login window when they navigate to, e.g., \\WIN7SVR in Windows Explorer, but we do not have a domain and synchronizing accounts between the server and clients would be intractable. There are both Windows 7 and Windows XP clients that need access to these shares.

I got this working for Windows 7 clients by just enabling the Guest account on WIN7SVR and setting appropriate share permissions. Other Windows 7 machines automatically try logging in as Guest, it seems, so their users don't have to deal with the login window. The problem is with the XP clients--they can access the server if the user enters "Guest" in the login window, but I don't want users to have to do that. So from what I gather, in my limited understanding of Windows file sharing, this boils down to granting null sessions access to file shares on WIN7SVR.

But I've had no success so far on that front. I've tried all the following in the local group policy editor on the Windows 7 server:

• Set Network access: Let Everyone permissions apply to anonymous users to Enabled
• Set Network access: Restrict anonymous access to Named Pipes and Shares to Disabled
• Added the names of corresponding shares to Network access: Shares that can be accessed anonymously
• Added "ANONYMOUS LOGON" to Access this computer from the network under User Rights Assignment

Any advice would be highly appreciated... I'm mostly a Unix guy, so I feel somewhat out of my league with Windows file sharing. I do understand that any sort of anonymous access to file shares isn't generally ideal from a security standpoint, but it's the most practical solution for us in this case, and access to our network is well enough controlled that share-level security isn't a concern.