System Admin

Tomasz Sowinski10-Jul-01 5:01

Tomasz Sowinski

10-Jul-01 5:01

You can't block Ctrl+Alt+Del on NT/2K. Check the KB article Q125614 for more info. BTW - why do you need this feature?

Tomasz Sowinski -- http://www.shooltz.com

11-Jul-01 21:26

I need this feature for a kiosk style application. I understand the security implications and also that a new keyboard filter or a replacement GINA dll are the only ways to do this. But just looking for info as there is a paucity of time. Of course, if these are the only ways to do it, then so be it.

Thanks
Anil

wParam31-Jul-01 13:29

wParam

31-Jul-01 13:29

Actually, you CAN disable those keys, but it involves terminating winlogon. I didn't notice any drastic effects, the most notable thing was the lack of ctrl+alt+delete (at that point I could use RegisterHotKey and catch it in my own apps) and the inability to shut down the system. (You can't shut down by ANY MEANS. Blue screen or reset buttons are your only chioces.) Here's what you do:

Terminate smss.exe. (You'll need SeDebugPrivelege)
Terminate winlogon.exe.

There you go. I'm told that all smss.exe does after the system is running is wait on various things and bluescreen when they terminate. So by killing it before winlogon you get rid of winlogon without the bluescreen normally associated with it. If you wanted to get really advanced you could try to figure out which thread in smss.exe was the culprit and just kill the one thread.

Use at your own risk! I myself don't fully understand all of winlogon.exe's functions.

Stupid name? Yeah. I know.

Image File Execution Options & ApplicationGoo

Christopher Lord3-Dec-01 19:41

Christopher Lord

3-Dec-01 19:41

Create a new user on the computer with limited security.

from your administrative account, remove read access from taskmgr.exe.

This will prevent the task manager from coming up.
There are ways of securing the rest of the 2K C+A+D screen like lock computer with the policy editor.

I also have a kiosk program running on XP now, and a locked down user account is the best option.

XP is nice because I can use terminal service into the admin account, and let the system auto-logon to the limited account.

Telnet and a collection of WSH scripts is also very VERY useful for when you dont want to inturupt the main screen, which terminal services does.

mouse rollover

5-Jul-01 10:05

Does anyone know what Windows function/event I can use to trigger an action on a mouse rollover?

Re: mouse rollover

moliate8-Oct-01 20:59

moliate

8-Oct-01 20:59

Rollover on what?

If the target is (derived from) a window, try the WM_MOUSEMOVE message. If the mouse is not captured, the WM_MOUSEMOVE message is received by the CWnd object beneath the mouse cursor.

5-Jul-01 5:33

Hi everyone,

Does anyone have *any* idea how the ApplicationGoo registry key parameter works on Win2K? In fact, does anyone have a list of what parameters are available under the keys within Image File Execution Options?

For those that know even less than me about this...

Under the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Image File Execution Options

there are a Image File Name keys such as; qpw.EXE, cqw32.exe, install.exe, wpwin8.EXE, setup.exe (some of the vendor specific ones are obviously recognisable). Under each name key there are parameters such as DisableHeapLookAside, GlobalFlag (these seem to be booleam values as REG_SZ) and then there's the mysterious REG_BINARY ApplicationGoo...

I'm guessing its something to do with Win2K compatibility i.e. when Win2K starts executing an image file it checks this and gives appropriate warnings, but I could be utterly wrong.

I've hunted the Internet & MSDN for a quite a while but can't find anything of substance. Any ideas out there? Am I just being particularly dense? Someone give me some pointers?

Anyway, kudos to the first on the buzzer with the right answer.

TIA,

Trevor

Re: Image File Execution Options & ApplicationGoo

Tomasz Sowinski5-Jul-01 5:40

Tomasz Sowinski

5-Jul-01 5:40

ApplicationGoo looks like version resource stored in registry, at least on my machine. Have no idea what they're using it for. Maybe for comparing currently executing image with the one executed before?

Tomasz Sowinski -- http://www.shooltz.com

Network Security Issue

Stan Shannon3-Jul-01 7:25

Stan Shannon

3-Jul-01 7:25

We have a client/Server application which, on the server side, runs on a dedicated, stand alone, server. We have a logon procedure by which we force users to authenticate themselves to us when they logon with a username and password. We would like to avoid this for those users who access our service if they are already properly logged onto their local network.

For example, what we want is to have some means of identifying a user trying to log onto our system as a properly authenticated member of domain XYZ of their network server. Is there any means of acquiring network information from the client side, which can be passed to our server which would allow us validate a user automatically? Clients might be running under Win 95/98.

Also, is there any way to uniquely identify a given network domain? That is, can we distinquish domain XYZ of one network, from domain XYZ of another network using the standard Windows networking API?

Anders Molin9-Jul-01 2:48

Anders Molin

9-Jul-01 2:48

If the client use Named Pipes to talk to the server, you can do it pretty easy.
Named Pipes supports NT Security Smile | :)

If you want to know more about Named Pipes and NT Security, I recommend the book: "Programming Server Side Applications for Windows 2000", from MS Press...

- Anders

Money talks, but all mine ever says is "Goodbye!"

Stan Shannon10-Jul-01 4:27

Stan Shannon

10-Jul-01 4:27

Thank you. I will look into that. However, one quick question, doesn't the use of a named pipe imply that you have a service running on the server in question in order to establish the converstation between client and server? In our situation, our service is running on a server external to the primary network that a client might be on. We simply want to be able to basically "piggy back" off of their existing network security so the user does not have to log on twice, once to get onto their network, and once to get into our service. No solution that requires us to have something running on thier server is going to work. We need to have information from the client relative to its status on the network so that we know that when the client calls us, it can tell us if it is, in fact, properly logged on to the its network.

Anders Molin11-Jul-01 4:27

Anders Molin

11-Jul-01 4:27

Ohhh, now I know what you want, and you are right, you cannot use Named Pipes for that.

I guess I would get my client app. to chech that the user is authentificated against a DC, and send a special packet to the server, when connecting, saying "I'm ok

- Anders

Money talks, but all mine ever says is "Goodbye!"

Stan Shannon11-Jul-01 5:06

Stan Shannon

11-Jul-01 5:06

Thanks. I think that is what we have decided to do. Unfortunantly, to do that authentication from 95/98 does not appear to be straight forward, and might involve the use of the old 16 bit network api.

Windows 2000 API

3-Jul-01 6:57

Can anybody please tell me where I can find a list of the functions in the DLL's and the parameters they require?

J Patel3-Jul-01 7:02

J Patel

3-Jul-01 7:02

Use Depends.exe to find out the names of the funtions. Some functions are documented i.e. you can find help in MSDN. Some functions are NOT documented, but you may be able to find their parameters in some header files and some just aren't documented which makes it more difficult to figure out the parameters.

HTH

Jignesh

3-Jul-01 7:23

Thank you very much. Smile | :)

3-Jul-01 8:04

Can you recommend a good book on these functions?

J Patel3-Jul-01 8:22

J Patel

3-Jul-01 8:22

Hmm, I really don't know of any one book which just talks about functions. I just use the online help.

If you do want to know more about undocumented calls, etc then
Inside Windows200 would be a good start.

HTH

Jignesh

3-Jul-01 10:03

Thanx