[matt27588]

Hi, Does anybody know how i could stop auto runs being added to the registry.

What keeps happening is that applications such as msn messenger keep adding themselves to the auto run in registry.

This is due to the kids just clicking add to windows startup, however they are all on limited accounts, but this does not seem to change the fact it keeps changing in the registry.

I didnt know if t was possible to have a script that would delete all the unwanted autoruns on logoff and just leave things like antivirus and firewall.

Many thanks

Matt

 

[jimmy]

Hello, good question, sadly I don't have an answer but someone else might.
Try using a program like spybot this will disable anything being added to the regidtry, and it will also provide protection against spyware.

Try using msconfig and disable that particular entry, you might have already probably tried this.

I am surprised that a limited account user can do this, what if you change the account into a guest will it still cause problems?

 

[matt27588]

I am not sure that changing them to a guest will have much effect, although it could do. Will have to try it. I frequently use msconfig, as well as manually removing the entries from the registry. I have also used spybot teatimer, to prevent the registry being changed without consent, although this does not stop the kids just clicking yes/allow when it pops up.

I was thinking that their maybe a way to delete the whole run key, with a batch file or somthing, and then be able to restore just the entries that I want by using a presaved .reg file, and just re merge this into the registry.

Cant seem to find anything on the internet about it though.

Matt

 

[jimmy]

I know what you mean, but I am sure in spybot if you set an entry to disable then you will not get the allow/block because it will be blocked in the background.

Try using a program called winpatrol, it is free to download, I use it but I have never tested it for this though it does have alot of functionality particularly one to disable stat-up.

http://www.winpatrol.com/startup.html

Read in here and it does permanently disable it.

 

[CCT]

I think what you may want is to set a Limited Account for each/all the kiddies.

http://www.microsoft.com/protect/computer/advanced/useraccount.mspx

 

[jimmy]

I may be wrong but I think their accounts are limited already. Check post 1. Though still puzzling that a limited account allows modification or entries to be added to the registry.

 

[CCT]

That was my thought faradd - Limited isn't written up to allow that from what I see.

 

[jimmy]

This might work if the users have password.
Click start then run and type control userpasswords2
check the box users must enter a password
then go to the user name and click properties,
then click group membership,
and make it as restricted user. Click apply and OK.

Now this means that every user wanting to access the computer will have to type a password. You can also in here choose a default user to be auto logged in if preferred or leave it.

 

[CCT]

I am thinking it may be necessary to go into Control Panel, Administrative Tools, Local Security Settings, Local Policies, User Rights Assignment and make the changes there.

Since this is a sensitive area, some reading ahead would be a GOOD thing.

 

[jimmy]

Also to access local group policy, you will need windows XP professional.

 

[matt27588]

Thanks for all of the advice, each user has been setup as a limited account (Restricted account). I always use contol userpasswords2 to setup my useraccounts as well, as i find this quicker, and a bit more functional than the applet in the control panel. I also have windows xp pro.

It is definetly a strange one. Although it does not seem to be the kids that are making the changes as such.

It is the program that is running, therfore if this is running under the system account, or network service/local service then it might have elevated permission compared to the limited account. Obviously it is loaded at startup, then a user logs in and it loaded as such. Really strange, I dont know if you have any more ideas on this one. But will have a look into the local policies and see were we go from there, maybe even have a look in gpedit.msc.

I also have another thread open atm, i dont know if any of you have any ideas about that problem either, but i would be very grateful if you could take a look at this, and see if you can come up with any suggestions, btw, did i mention that this is a clean install???

 

[jimmy]

Hi, did you try winpatrol? also you could try this
Go to run then type services.msc
the find messenger there and under start-up click disable.

 

[matt27588]

Hi. I have not yet tried win patrol but will do as soon as i can, i know for sure that the messenger service is disabled. However I am not sure why you think this is related to msn messenger. as the messenger service as i understand it is for sending 'net send' messages.

matt

 

[me4net]

Have you tred to use msconfig to remove apps startup?

 

[jimmy]

Hi. I have not yet tried win patrol but will do as soon as i can, i know for sure that the messenger service is disabled. However I am not sure why you think this is related to msn messenger. as the messenger service as i understand it is for sending 'net send' messages.

matt

Very true, but I am sure the service can be disabled from here, though I have disabled other app services from here not msn. Still looking for which service it is.

 

[matt27588]

As far as i know msn does not run as a service, it is just an application that runs, and likes to add itself to startup.

ME4net: the problem is not disabling it or removing it from startup, i know how to do that via msconfig, however i prefer to do it through the registry, it is the fact that the app keeps adding itself to startup. please read the other posts for more information on what we have already discussed and tried.

 

[jimmy]

Hey, try a different program instead of msn messenger. Try something like Integrity Messenger, which supports both yahoo and msn and is also free. Or something similar.