Severely limiting users' access?

[l Thomas l]

Is there any way to limit someone's access to your computer? I don't want them downloading anything or changing any settings.

I sort of want to lock up my hard drive for when they use it, if that's possible. I know it isn't completely possible, because I'm sure it would mess up some stuff with Windows, but at least a partial lock.

Is there anything that can do this for me? It's pretty urgent because I have 2 people using my computer now and I'm really paranoid of them doing anything. (plus one of them still surfs with IE and I JUST uninstalled IE7 because I had some conflicts. :disgust: )

 

[Lord Evermore]

Give them Limited User accounts, that will severely curtail what they can and can't do.

 

[l Thomas l]

I've already done that.

 

[Lord Evermore]

Well how much less accessibility do you want them to have? They shouldn't be able to do anything that affects the rest of the machine. I suppose you could create a new user type that disables even the limited amount of control a Limited User has. You can also use the group policy editor to limit them even further I think. I don't know if you can go so far as to make it impossible for them to go find files on the hard drive that aren't encrypted and/or stored within the personal folders of other users.

You could just make a Ghost/backup image of your drive before letting them use it, then wipe the system and restore the image when they're gone. That way nothing they do can actually affect your use of it.

 

[l Thomas l]

Yeah the image of my hard drive would be the best idea but I don't have my external hard drive right now.

I guess the main thing is I don't want them downloading any new files (creating). I can sort of restore any settings they may change, but the biggest thing is not letting them download anything.

 

[Lord Evermore]

You can change the settings in IE (the security tab custom settings has an option to disable downloads) or with the group policy editor to disallow file downloads, but there's no way to prevent the actual creation of files as far as I know. So if they had some other utility like ftp (which you could disable access to the program) or anything else that could download a file by bypassing whatever settings you have, then they can still save it.

 

[nova2]

use ntfs permissions to deny the limited account's access to all drives/dirs/files you desire.

make sure your machine is up to date, else they could exploit privilege elevation vulnerabilities and act as an admin

 

[Lord Evermore]

Doh. Didn't even think about using permissions. The only limitation to that of course is not limiting permissions to the point that they can't actually use the computer. For instance, cut permissions on the Internet cache folder and they may not be able to browse, but if you don't block, they could save files there.