My Space

[old volunteer]

I support several volunteer library PC's running Win2000. Each are
configured separately but run through a common router to the Internet - they
do NOT run through a server. Security is set up so I have the typical Win
Admin security and users have the typical "guest" security. This means guest
cannot add or delete programs. But... I notice some of users will be able
have the "My Space" interface on them. The only way I can remove the My
Space interface is by going to Add/Delete programs in the control pannel -
and I can do this logged in as guest! Why is guest allowed to add/delete
myspace? Is there a flaw in the way I set up security? Thanks for a
response.

 

[Malke]

old volunteer wrote:

> I support several volunteer library PC's running Win2000. Each are
> configured separately but run through a common router to the Internet -
> they
> do NOT run through a server. Security is set up so I have the typical Win
> Admin security and users have the typical "guest" security. This means
> guest
> cannot add or delete programs. But... I notice some of users will be able
> have the "My Space" interface on them. The only way I can remove the My
> Space interface is by going to Add/Delete programs in the control pannel -
> and I can do this logged in as guest! Why is guest allowed to add/delete
> myspace? Is there a flaw in the way I set up security? Thanks for a
> response.

You shouldn't be using Guest. Disable Guest and create a new user account, a
standard user account. The Guest account is a special system account. It is
disabled by default in Windows XP, Vista, Linux, Unix, and OS X for a
reason.

From TechNet:

"The Guest account is intended for users who require temporary access to the
system. However, if this account is enabled, a security risk may exist
because an unauthorized user could gain anonymous access to the system
through this account."

http://technet.microsoft.com/en-us/library/bb418978(TechNet.10).aspx

So if you enabled Guest, disable it now. Call the new user account something
like "Visitor" or in your case, "Library User".

You can use Group Policy in Win2k to limit what those users can do.
Questions about using Group Policy can be asked in its newsgroup,
microsoft.public.windows.group_policy.

You can also look at Doug Knox's Security Console or the MS SteadyState
program to set the restrictions the way you want. You'll have to check to
see if either of those programs supports Win2k.

http://www.dougknox.com
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx
More on SteadyState: http://aumha.net/viewtopic.php?t=27570

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ