Office of Homepage Security.

Factual Questions
1

One of my many jobs is maintaining several computer labs here at the University. We have them pretty well locked down with a program called “fortres” which protects many things.

One thing I cannot protect is the Internet Explorer Home Page. When the machines are in Fortres mode, one cannot access the menu bar, but they can, if they’re at a site that allows it, can change the home page by clicking a link that states “Click here to make xxx.com your homepage!” The result is a lot of work changing the homepage back to something that is not porn or aol.com.

I even protected the registry entry but Explorer must be able to get past that. Is there any way to absolutely prevent that registry entry from being changed?

Thanks.

2

The key is stored here:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control
Panel]

You should be able to make a .reg file that will import this on boot.

However, you didn’t say anything about what OS, etc these computers were, but this should get you started.

3

You could always disable Java / Javascript,
or alternatly use a log on script to import the
key as above.

4

I don’t have a solution, but I do have a workaround. For the labs I’ve helped maintain, I write a little app that does all the local maintenance tasks like resetting registry entries, wiping temp files, wiping user filespace, resetting wallpaper, turning off screensaver, etc. I keep the app on the fileserver all the machines are attached to, and run it periodically on each machine (as a chron job at 6 am or on startup, depending on whether the lab protocol called for shutting down machines at night).

This doesn’t really fix the problem that users are able to do things they’re not supposed to do, but it makes cleanup easy.

5

You could try using IEAK to do a custom build of IE that looks for a centralized server to get it’s settings each time the program is started. Look here for more info about it. http://www.microsoft.com/windows/ieak/evaluation/business/default.asp and here http://www.microsoft.com/windows/ieak/default.asp

6

All good replies.

I neglected to state that these machines are using Windows 98.

It’s infuriating that protecting the registry key doesn’t keep this from happening.

Thanks.