We at the High School have a site license for FoolProof Security . You can disable Control Panels, restrict the installation of programs, allow file saving to only a specified directory, disable DOS commands, Safe Mode, access to the hard drive with a boot disk, and on top of it all you can set these restrictions based on NT group membership. You can do most of what I described above using Microsoft Policy Editor, but there are some reasons that this method does not work as effectively as on win9x machines. When a user is allowed to do these things they can easily compromise the security of the machine by installing trojans or viruses while in DOS mode. MS Policies do not work unless you enable Profiles .
Profiles are messy and muck up the machine with unnecessary files.
Especially here at the high school where we could have up to 600 different users on a machine over the course of a year. Q165990 MS policies are a simple matter to get around. First we have to consider the name FoolProof. No security system is foolproof. For the most part FoolProof does the job, but there are a few things you can do to increase the security and thus the likelyhood that a user will bypass it.