Disable IE on NT4 Workstation

G

Grimmda

2[H]4U
Joined
Jul 1, 2003
Messages
3,130
I have a situation where we are running Windows XP/SP2 and have the VMWare Player application running an instance of NT4.

This is due to the fact we have a VERY old antiquated program that only runs on NT4 (boo hoo for us).

We've got the app working in the VMWare instance just fine. But I would like to disable Internet Explorer in the NT4 portion.

I've done some google searching and have found lots of "messy" ways. I'm thinking of quick and easy. The thought of just renaming iexplore.exe has come up as the easiest and I might go down that road but I wanted some opinions here first.

So bust out your "Way back when" hats and see what you can come up with.

The users will NOT be local Admins on there XP or NT portions so we won't have to worry about that. I'm also pondering providing NO Proxy connection information so the only sites that would work would be internal ones and that would be fine. Maybe that's my answer.

Thanks guys
 
So you use a proxy to get outside the network? Just don't put it in. Better yet point it to a dead proxy or a loopback. You can also change just change the gateway if they don't need to access anything on the outside.
 
SO I tried going down the "shut off the proxy.pac file" and dangit but I can't figure that out. Sure it's easy and I've configured it for XP but nooo gpedit.msc isn't in NT to configure that. I tried the install.ins file but editing that didn't seem to make my test user stop pointing to the proper .pac file
 
Grimmda said:
SO I tried going down the "shut off the proxy.pac file" and dangit but I can't figure that out. Sure it's easy and I've configured it for XP but nooo gpedit.msc isn't in NT to configure that. I tried the install.ins file but editing that didn't seem to make my test user stop pointing to the proper .pac file
Click to expand...

Just point the getway to something other then what it really is under the ip settings. That should stop it
 
swatbat said:
Just point the getway to something other then what it really is under the ip settings. That should stop it
Click to expand...
Just point the gateway to it's own IP, and you should be fine.
 
Yeah but the NT instance needs true network functionality for this aplications because of course there's all sorts of things it needs to connect to to work.

SO wouldn't screwing the gateway jack the rest of it's network functionality?
 
Grimmda said:
Yeah but the NT instance needs true network functionality for this aplications because of course there's all sorts of things it needs to connect to to work.

SO wouldn't screwing the gateway jack the rest of it's network functionality?
Click to expand...

No, because the gateway only tells the machine how to get out of its local subnet. We do this with our RIPs. The gateway is pointed to the machine's local IP Address, and we install all updates/patches from a file on the internal HDD. It doesn't keep the Prepress employees from logging in to jobs, looking at job logs, looking at their webmail, or clocking in on them.
 
I'll need to go a different direction with this because this PC will have to get out of it's own Subnet for the required network access the application requires.
 
You're sure the app doesn't run in XP under the compatibility mode? ;)

Yeah that makes it a little more difficult.
 
NewBlackDak said:
You're sure the app doesn't run in XP under the compatibility mode? ;)

Yeah that makes it a little more difficult.
Click to expand...

I wish! That's the question I asked, but then I looked at the app and it's 5 or 6 other programs that go along with it to make it work... Parts of it even being old 16bit apps! It's a scary beast.

And as far as group policy I was going to try and figure that one out but I decided to finish this the "cheap" way.

I renamed iexplore.exe, made "administrators" have Modify rights to the folder IE is in and have tested it out... looks good enough to me.

I think in my case this solution will "work" and is maybe not the "most secure" way to get it done, but my security department is happy so I'll be happy. It's also using NAT to communicate with the Host OS so that's another layer of protection on it.
Thanks for trying guys!
 
Maybe set the proxy in IE, under Tools, Internet Options, Connections tab to something thats wrong.
Im thinking a regular user wouldnt be able to change it
 
Just deny the "Everyone" group access to iexplorer.exe. Unless the user is an admin and can take ownership of the file to reset the permissions, that will take care of it.
 
You must log in or register to reply here.
Back
Top