The Old Joel on Software Forum: Part 4 (of 5) - Disable WSH using Group Policy?

Disable WSH using Group Policy?

Hi all!!

Another of my "PITA" questions.

I have to find a way of disabling WSH using Group Policy.
I've had a look on the templates provided with the Local Security Policy on my computer (W2000 Server), and I can't see any "ready made" policy for that (can't logon to the server ATM).

I've been googling, and the only liekly thing I've found would be on:

http://users.iafrica.com/c/cq/cquirke/riskfix.htm#FindAndKill

As I see, having a batch file that renames the WSH interpreter would be a way.... But that strikes me as unelegant, so I was wondering if there is any "cleaner" way to do it....

Javier Jarava
Friday, March 12, 2004

http://msdn.microsoft.com/msdnmag/issues/02/05/wsh/ might help you out.

Just me (Sir to you)
Friday, March 12, 2004

<rant>

I always wonder where the locking down of boxes is going to end.

Why not just put all of your users on WebTV and take away their PCs?

I love how "admins" love to do their job by making their jobs trivial at the expense of the rest of the organization. It reminds me of last summer during the "slammer" storm.

The SQL Server box admins and the desktop admins sat outside for weeks on their Nextels smoking. "Patches? Patches? We don' need no steenkeeng patches!" Slammer hits big, and after a few days management kicked their butts to get 'em moving. As soon as things were just about cleaned out and patched, the network admins decided to block port 1434 between segments all over the network. Nothing could get to the SQL Server boxes (among other things) anymore and it took another two days to get it ironed out.

Just yesterday the network idjits blocked another port or addres range and we have no OWA access anymore. Plus several major ISPs have been blackholed so we don't get email from a bunch of outside clients now.

So yeah, don't let me automate tasks for my users via WSH or HTAs guys, just block everything so you can relax and have another Marlboro.

</rant>

Bob Riemersma
Friday, March 12, 2004