Question: Windows and the Public

[Bill Pardue]

**************************************************************
      Bill Pardue, Electronic Resources Librarian
                Paul V. Galvin Library
           Illinois Institute of Technology
                  Chicago, IL  60616
312-567-3615    312-567-5318 (fax)   pardue at charlie.acc.iit.edu
***************************************************************

On Fri, 12 Jan 1996 CAROLINE at lib.uttyl.edu wrote:

>   Greetings WEB4LIBbers!
>   
>   1.  Keep up the good work!
>   2.  We are a small academic library providing WWW access
>   with Netscape and Windows 3.1.  The P.C.'s are in a public
>   area that cannot be policed regularly.  Is there a
>   way that I can limit access to the MAIN (and others) 
>   program group?  I know I can just delete all the groups
>   and keep File Manager available elsewhere, but I'm 
>   hoping for something a little more sophisticated that that.
>   Effectively I'd like to hide select program groups by a means
>   other than dragging them aside and minimizing the Program
>   Manager window....
>   
>   Ideas?
>   
>   Caroline Allen
>   Systems&Archives
>   University of Texas at Tyler
>   
>   Caroline at lib.uttyl.edu
> 
> End of returned message
> 
> 


The following was passed on to me by our network guru.  There are three
parts (best done in order).

---------------------------------------------------------------------
PART I

****Creating one group for the programs you want to run (and clearing out 
all the others):

1)  In windows, in the program manager, go under "file"/"new".  Select 
"program group" in the dialog box that pops up.

2) When asked for the name of the group, call it "DG Library Programs" 
(or whatever you want) on the Description line.  Leave the group file 
name option blank.

3)  Copy the icons for the programs you want into the new program group 
(you can copy icons by dragging and dropping them while holding down the 
ctrl key).  It's probably not a good idea to include file manager in this 
group, because it will give people the opportunity to run programs and 
access files you don't want them to get into.

3) In Program manager, go to "file"/"run" and type progman.ini

4) When progman.ini opens up in notepad, go to the [Groups] section of 
the file and put a semicolon before each line for a program group you 
don't want to show up.  You probably only want to leave the one you just 
created.  Don't just erase the lines from the file and don't just delete 
the program groups from the desktop, because you may actually want the 
groups back some day.  Save and close progman.ini.

>From that point on, whenever windows opens, there will be only one 
program group in the program manager (even if you maximize the program 
manager window).  It will only have the programs you want people to 
run.Making it darn near impossible to alter the windows settings:

--------------------------------------------------------------------------

PART II

****Making it relatively hard for people to mess with windows settings

(As outlined in the January 94 Windows Magazine)

1)  Make a backup copy of c:\windows\progman.ini (progman.bak is  good)

2) Open progman.ini in an editor and add the following lines to the 
[Restrictions] section:

        NoRun=1
        NoClose=1
        NoFileMenu=1
        NoSaveSettings=1
  (If there is no [Restrictions] section, then create it.)

  Under [Settings], add the line:
         SaveSettings=0

Close the file and exit the editor. Exit windows.  Next time you go into 
windows, it will be impossible to exit windows, short of shutting off the 
machine.  In  fact, the "File" menu won't even appear.  People also can't 
run any programs other than what you've set up on the windows desktop  
for them to use.  You can keep the computer from going  into windows by 
hitting F8 after you see the "Starting MS-DOS" message.  You will now be 
asked whether or not to go on before each command of the autoexec.bat 
file is executed.  When it gets to the "win" command, answer "N".  You 
could also boot from a system disk in drive A:, but that won't load all 
the other things you   might want in autoexec.bat/config.sys (unless you 
make an autoexec.bat  and config.sys for that disk)

----------------------------------------------------------------------

PART III

***Making it very tough to tamper with really important DOS and Windows 
files:


1)  Go to the c:\> prompt (the root directory) and type:
	  attrib +r *.*

2) Go to the c:\windows> directory and type:
	 attrib +r *.ini

[You've just made the dos root directory...where autoexec.bat and 
config.sys are...read-only, as well as the windows initialization files.  
No one can change the settings in those files.]

3) Place an empty diskette in drive a:

4) Copy the following files from the c:\dos> directory onto the diskette:

     c:\dos\attrib.*
              \edit.*
              \qbasic.*

5) While in the c:\dos> directory, delete:
            attrib.*

[What you've done is  deleted the file necessary to change file 
attributes from read-only to read/write.  However, you may want to change 
the attributes of the root directory or the windows 
intitialization files back--especially if you need to install a program 
or change settings in autoexec.bat, config.sys, etc.  Simply place the 
diskette on which you copied the attrib.exe file in the a: drive.  Go to 
the c:\> (root) directory and type a:\attrib -r *.*  Then go to 
c:\windows>  and type a:\attrib -r *.ini    When you're done making the 
necessary changes, redo steps 1 & 2 above 
(make sure you type "a:\attrib" instead of just "attrib" , since it's not 
on your hard drive anymore)