Discussion:
[cw-discuss] Prevent users from installing windows programs
(too old to reply)
Mike
2008-08-03 20:42:45 UTC
Permalink
Hello,

Once Crossover Linux is set up and the needed software is
installed and running, is there a way to prevent end users
from attempting to install additional Windows software on
their computer? The problem I'm having is that I set up
Crossover and IE for our users on their Ubuntu desktops and
now they are trying to install fancy Windows screensavers and
spyware loaded wallpaper executables.

I've already talked to them and asked them not to do this
(which apparently had no effect). How can I prevent these
users from attempting to open and install windows executables
once the required windows software has been installed?
James McKenzie
2008-08-04 01:33:08 UTC
Permalink
Post by Mike
Hello,
Once Crossover Linux is set up and the needed software is
installed and running, is there a way to prevent end users
from attempting to install additional Windows software on
their computer? The problem I'm having is that I set up
Crossover and IE for our users on their Ubuntu desktops and
now they are trying to install fancy Windows screensavers and
spyware loaded wallpaper executables.
I've already talked to them and asked them not to do this
(which apparently had no effect). How can I prevent these
users from attempting to open and install windows executables
once the required windows software has been installed?
I don't know of any way to do #1. However, what is your company's
policy about installing software. Showing a few people the door and
advising them that they have placed the company 'at unacceptable risk'
might get the rest to stop. This is definitely a company policy issue
at the core. That is and was the policy at my current employer and past
employer. All software has to be vetted and have a positive effect for
the company. BTW, letting your users customize the appearance of their
desktop should not be a major problem. Installing spyware and other
noxious items definitely is.

Maybe someone from Codeweavers will step in and give other advice on how
to prevent installation of other software products

James McKenzie
Jeremy White
2008-08-04 02:14:48 UTC
Permalink
Hi Mike,
Post by Mike
I've already talked to them and asked them not to do this
(which apparently had no effect). How can I prevent these
users from attempting to open and install windows executables
once the required windows software has been installed?
If you use CrossOver Professional, and 'publish' a bottle
(which we used to call 'Managed Multi User Mode'), then each
user will have a throwaway 'local' bottle.

You can then write a login script that does a rm -rf ~/.cxoffice;
that will forcibly move the user back to the stock installation.
That way it guarantees that, even if they do install software,
it won't be saved.

We've done custom work for other customers to put in place
more stringent restrictions, but we've done that on a case by
case basis. You can write to us via the sales channel if you'd
like to explore having us do that for you.

Cheers,

Jeremy
Francois Gouget
2008-08-07 09:59:40 UTC
Permalink
Post by Mike
Hello,
Once Crossover Linux is set up and the needed software is
installed and running, is there a way to prevent end users
from attempting to install additional Windows software on
their computer? The problem I'm having is that I set up
Crossover and IE for our users on their Ubuntu desktops and
now they are trying to install fancy Windows screensavers and
spyware loaded wallpaper executables.
It's not possible to let users run existing applications while
preventing them from installing new applications. That's because
installing an application just means running a Windows executable which
you also need to allow to run existing applications.

I'll add some other countermeasures to what Jeremy suggested:

* Disable the .exe association
The following command should do it (prepend the appropriate path).
Running arbitrary executables will still be possible but only from the
command line.

cxassoc --filter .exe//run --mode ignore --uninstall


* Remove the 'Install Windows Applications', 'Run a Windows Command'
and 'Configuration' menus.
They will still be able to run these from the command line though.
In particular, as the administrator, you'll have to start cxsetup by hand.

cxmenu --crossover --filter 'StartMenu/Install Windows
Software:StartMenu/Run a Windows Command:StartMenu/Configuration' --mode
ignore --uninstall

(all on one line, prepend the appropriate path)


With these in place it should be less tempting to just try random
executables.


Regards,
--
Francois Gouget
fgouget-***@public.gmane.org
Loading...