Windows Permission denied running application _ server other

One: Prohibit downloading programs

Many times, clients like to download a lot of things. This not only occupies a lot of bandwidth, but also easy to virus, resulting in system paralysis. And as a network administrator you have to redo the system. Do you ever want to let that happen again?  Then disable the client to download things. Specific methods:

•: Prohibit access to a Web site
You can add the site's domain name to the Hosts file and assign a wrong IP to the domain name. If the specified www.baidu.com IP is 0.0.0.0, the user will send the data to 0.0.0.0 this IP when accessing www.baidu.com. thereby forbidding users to visit Baidu this site.
Specific methods:
First step: Open the C:\windows\system32\drivers\etc\hosts file (opened in Notepad).
Step Two: Add 0.0.0.0 to this IP at the end of Notepad and follow the domain name (www.baidu.com) that you want to disallow access to.



•: Prohibit ie download
You can disable IE downloads so that when you click on the resource you want to download, the "Current security settings do not allow downloading of this file" prompt box or no prompts. So you can't download anything.

Specific methods
The first step: Point ie "Tools" menu
Step Two: Click "Internet Options ..." and pop up a dialog box.
Step three: In the dialog box, click the Security tab.
Step Fourth: Click the "Custom Level ..." button.
Step Fifth: Locate the "download-File Download" entry and select "Disable" in the following radio box.
Sixth step: Determine the further determination.
Although this is simple, it has its drawbacks. The user can also find the "download-File Download" Item and enable it. So after we disable IE file downloads, we also disable the IE Security tab in Group Policy. So that the user cannot change.

Specific methods:
Open Group Policy, locate user Configuration → admin templates →windows components →internetexplorer-------Internet Control Panel and double-click the "Disable Security page"------Select "Enabled"

• No Peer-to-peer downloads
Many times we are through Peer-to-peer software (Thunder, Express, Electric donkey, etc.) download. This is not valid by prohibiting IE from downloading files. At this time we should use a ban peer-to-peer download tool, "Peer-to-peer Program shielding tool." It allows your computer to not uninstall the Thunder and other software to prohibit its operation. Download Address http://www.hylmlt.com/viewthread.php?tid=53451



II: Prohibit installation
Although users can not download things, but users may also install the software by other means, such as through CD-ROM, u disk and other mobile devices installed. Because of my limited ability, I didn't find any software to prevent users from installing the program, but we can prevent users from installing the application by lowering the user rights. Specific methods:

Create a new account, set as a limited account
This solves the problem of the user installing the application, but can be installed if the installation file name is not SETUP.exe or install.exe.
So you also need to disable some features

Start--run--enter "gpedit.msc"--Computer configuration--Administrative Templates--windows component--windows Installer, you can disable Windows Installer
This can prevent most software installation, the administrator in the installation, and then enable it!


Three: Prevent the application from running.
• Use Group Policy to prevent users from running an application
Specific methods:
Open the Group Policy Editor, locate the User Configuration------Management Module------system, locate "do not run the specified Windows Application" under System sub options, and double-click---------Select Enabled in the Open option and click Show------ ------then "add" and enter the name of the application (such as QQ) that you want to disallow. OK, sure.
In this way, users will be prompted to "this operation is canceled because of the permissions of this computer, please contact your system administrator"



• Use Ws2_32.dll files to prevent applications from running
Ws2_32.dll is a dynamic-link library file, which is located in the C:\windows\system32\ directory by default, and many applications need to invoke this file at run time. The order of invocation is: First search the file in the application's current directory, and if not, look for it in the system root, Windows\System32, and Windows\System directories, in turn.
We can create a new folder for Ws2_32.dll in the application directory. At this point, a "program initialization (0XC00000BA) Failure" message appears when the user uses the application.

• Use image hijacking technology to change the application that you want to run

The so-called image hijacking is in the registry [hkey-local-machine----SOFTWARE-----MICROSOFT----WINDOWS NT------Current Version-------Image File Execution Options] To create an application-named item (such as Qq.exe), and then create a subkey (string value) on the item (qq.exe) and name it debugger. In the pop-up window, enter the path to another software that you want to run, such as C:\Program files\ English practice. exe so users running QQ This application, the system will not open QQ, but run the software of oral English practice.


There are, of course, a number of ways to prohibit the use of the application, but I know these kinds of things for the time being (without the help of software). If there are more, simpler methods or errors in the article, please ask ... Everybody study together!