Windows Enforcer Version 6.1
Windows Enforcer, Version 6.1

Windows Enforcer protects systems that are accessible to many people and require a consistent configuration and a consistent, limited selection of services such as public displays or computer labs. It is also great for limiting users to the webpages you approve such as on a VPN or for childproofing individual systems. It is easy to configure and requires little to no modifications to your current system configuration.  Administrator functions available for site licenses only.  Windows 95/98/Me or NT/2000 required.

Installation, Registration, Upgrading, and an order form to print

Enforcer Setup (enfset.exe)

Task names and task name matching

User specified exceptions to a prohibited task

Menu	Menu Options
File	Log file, Event Sounds (WAV) files, Open Enforcer task file, Save as Enforcer task file
Options	Stealth Mode, Prohibit all tasks except those specified, Hot Key, Secure Desktop Wallpaper, Allow Windows logoff, Disable Windows shutdown, Never disable Ctrl+Alt+Del, Always disable Ctrl+Alt+Del, Disable Registry editing tools, Disable Windows update, Disable MSDOS prompt, Warning message, Start Enforcer at Windows startup
Tasks	Add Task, Edit task, Delete tasks, Task definition utility
Administrator	Hide desktop, Administrator password, Change user’s password
Help	Register
Buttons	Add Task, Edit Task, Delete Tasks, Password

Running Enforcer (enfrun.exe)

Command Line Arguments at Runtime

Security hints and tips (safe-mode, etc...)

Special Steps for Enforcing the MS-DOS

Special Note for NT/2000 users

Questions, Answers, and Examples

Our other products


Installation

To Install Windows Enforcer:

If you used the release that includes the InstallShield installation program then you have already installed the product correctly.  If not, then you probably do not have the latest version.  If you would like the latest version, visit our web page at http://posum.com/enforcer.html.

To Configure Windows Enforcer:

To get familiar with Enforcer, it is recommended that you go through the steps in Q1 of the Questions, Answers, and Examples section of this help file.  After this, start adding the tasks you need for your particular situation.  It is recommended that you add a few tasks at a time and test them.

If you wish to configure Enforcer so that it is executed whenever Windows 95/98 or NT/2000 starts up, use the Start Enforcer at Windows startup option . Once these steps are complete, reboot and your system is secure.

To Remove Windows Enforcer:

An uninstall program is provided with Enforcer.  You can use this through the Add/Remove programs utility on the Control panel or from the Start menu entries for Enforcer.

System Requirements:  Windows 95/98/Me or NT/2000.


Enforcer setup (enfset.exe)

Task List:  This list displays the currently defined tasks. To add a task, press the Add Task button.  To edit the definition of a task, select the desired task and press the Edit Task button.  To delete a task or tasks, select the desired task(s) and press the Delete Tasks button.

Add Task:  Press this button to display the Add Task dialog and add a new task to the Task List.

Edit Task:  Press this button to display the Edit Task dialog and edit the settings of the task that is selected in the Task List.

Delete Tasks:  Press this button to delete the task(s) selected in the Task List.

Password:  This button will display the Password dialog.  You may enter a password if one has not been defined or change the current password.  The password is used to terminate the execution of the Enforcer password dialog.  This is the only manner in which Windows Enforcer can be terminated.  Other attempts such as CTRL+ALT+DEL, ESC, etc. are protected against.

OK:  This button saves the current settings and dismisses the dialog.

Cancel:  This dismisses the dialog without saving the changes.

Dialog menu

File: Log file, Event Sounds (WAV) files, Open Enforcer task file, Save as Enforcer task file

Options: Stealth Mode, Prohibit all tasks except those specified, Hot Key, Secure Desktop Wallpaper, Allow Windows logoff, Disable Windows shutdown, Never disable Ctrl+Alt+Del, Always disable Ctrl+Alt+Del, Disable Registry editing tools, Disable Windows update, Disable MSDOS prompt, Warning message, Start Enforcer at Windows startup

Tasks: Add Task, Edit task, Delete tasks, Task definition utility

Administrator: Hide desktop, Administrator password, Change user’s password

Help: Register


Password Dialog

The password dialog defines or changes the password that halts the execution of the Enforcer (enfrun.exe).  The password is case sensitive and a password must be defined.

Old Password:  This field accepts the current password, if one exists, prior to a change.

New Password:  This field accepts the new or changed password.

Confirm:  This field accepts the new password again as a confirmation that it was typed correctly.

OK:  This button saves the changes and dismisses the dialog.

Cancel:  This button dismisses the dialog and does not save the changes.


Running Enforcer (enfrun.exe)

The Enforcer password dialog is used to accept the user’s password or the Administrator password to halt execution of Enforcer, enfrun.exe. If Stealth Mode was chosen, the dialog can only be displayed by using the user defined Hot Key. If Stealth Mode was not chosen, it will appear as an icon in the system tray. The password is required for the process to terminate.  Windows Enforcer should not be terminated in any other way.

Windows Shutdown is disabled by default when Enforcer is running.  Windows Shutdown will be enabled when Enforcer is properly exited using the password.  If you require the use of Windows Shutdown while Enforcer is running then you can un-check the “Options->Disable Windows shutdown” option in the setup (enfset.exe) to allow it.

Password:  This field accepts the Password defined during setup (enfset.exe).

OK:  This button accepts the password.


Security hints and tips (safe-mode, etc.)

Once you are satisfied with the configuration of Enforcer, it is time to take the final steps to secure your system.  We recommend that these steps be taken only after you have tested Enforcer and are satisfied with its configuration.

Hint#1: Configure Enforcer so that it executes as soon as Windows starts.

Hint#2: Disable ‘safe-mode’ and function keys as system boots.

Hint#3: BIOS settings.

Hint#4: Add more layers of security to your system.


Registration

If you use an unregistered Windows Enforcer you will notice that every time you enter a password on Enforcer’s Dialog (enfrun.exe), a box appears indicating you are unregistered. It will display the Hot Key (if used) and the password you entered using  Windows Enforcer Setup (enfset.exe).  When you send in your registration, we will return you a registration number that you will enter on the registration dialog (see below).  This dialog can be reached from the Help->Register menu item of the Windows Enforcer Setup Dialog.  This will register the software and you will no longer get the annoying box that displays your password.

Windows Enforcer is Shareware (see the Legal Stuff below).  If you feel that this software will be useful to you, please print the order form (follow this link), fill it out and send it along with your registration fee or credit card information to the following address.

Posum LLC

PO Box 21015

Huntsville, AL 35824

USA

For a fax number, secure online ordering, and the latest ordering information, visit our web site at: http://posum.com/ordering.html.  We accept US and international credit card orders.

If you are paying with a check or money order it must be in US dollars on a US or Canadian bank, payable to: Posum, LLC.

Site licenses are available for Enforcer.  Just follow the links for more details.

Please report any bugs, suggestions for improvement or new features you would like to see.  We can be reached through email at support@posum.com or at our web site at http://posum.com.

- Version 1.0

- Initial Release

- Version 1.1

- Corrected a bug that allowed shutdown during error dialog.

- Version 2.0

- Added the Execution Optional task setting and removed the

  50 task limit on the number of tasks that could be defined.

- Version 2.1

- Enforcer (enfrun.exe) now runs from the system tray instead

  of the Taskbar and a conflict with Windows Task Lock was

  corrected.

- Version 3.0

- Optional user specified wav files for the Startup and Access

  Denied events.  Protection against multiple copies of enfrun.exe

  running, task name matching from the beginning or at the end,

  a few bugs fixed and better performance when used with

  WorkStation Lock.

- Version 3.0b

- Corrected a bug that disabled the screen saver on some systems

  and a bug that truncated longer program filenames on the Add Task

  dialog.

- Version 3.0c

- Command line arguments now allowed on Must Run tasks.

- Version 4.0

- Added an optional command line argument to enfrun.exe for task

  execution.  This argument specifies a delay between the time

  a task is executed and it is checked for.  This delay is in

  seconds and is useful in requiring execution of programs located

  on CD-ROM or that take a few seconds to initialize.  A horizontal

  scroll bar was also added to enfset.exe and the product was

  fitted with an install program.

- Version 4.0b

- Added a variety of advanced command line arguments, updated the

  helpfile, and  enhanced the security of the password and task system

  information.

- Version 4.1

- Added the ability to disable CTRL+ALT+DEL and Windows Shutdown

  when Enforcer is running, added some additional command line arguments,

  and corrected a small bug In the Task Browser in enfset.exe.

- Version 5.0

- New Features

  Hot Key and Stealth Mode options.

  Secure you wallpaper from being changed.

  Increased Task name length to 256 characters.

  Added a sound event for bad passwords.

  Administrator functions for site licenses.

      - Fixes

  Improvements for securing Internet Explorer 4.0.

  Security improvements for CTRL+ALT+DEL on Windows 95.

  Improved encryption.

  Corrected a small NT bug.

- Version 5.1

- New Features

  Disable registry editing.

  Disable DOS prompt and DOS apps.

  Disable Windows Update (Windows 98).

  Alphabetized task list.

  Log File Support.

  Expanded help resources.

      - Fixes

  Corrected a bug with folders on Windows 98.

  Corrected an F1 bug in enfrun.exe.

- Version 5.2

- New Features

  Added an option to start Enforcer (enfrun.exe) from the

registry at Windows start up.

  Disable ESC key in enfrun.exe when dialog displayed.

  Updated and expanded help resources.

  Added user designation for logfile.

      - Fixes

  Corrected a bug in setup (enfset.exe) in NT.

  	  Corrected a bug in the -t command line option.

- Version 5.2.1

- New Features

  Added warning.exe

      - Fixes

  Corrected a bug in enfrun.exe involving the multiple

  execution of prohibited tasks.

- Version 6.0

- New Features

  Added the Task Definition Utility

  Added the ability to open and save task files

  Improved the usability of Setup

  Added uninstall support

  Moved command line options into Setup

  Expanded log file options

  Added Hide desktop feature for site licenses

- Version 6.1

- Added the capability to do wild card exception

  matching to never run tasks.  This was to improve

  Enforcer's ability to restrict websites.

LEGAL STUFF:

DEFINITION OF SHAREWARE

Shareware distribution gives users a chance to try software before buying it. If you try a Shareware program and continue using it, you are expected to register. Individual programs differ on details -- some request registration while others require it, some specify a maximum trial period. With registration, you get anything from the simple right to continue using the software to an updated program with printed manual.

Copyright laws apply to both Shareware and commercial software, and the copyright holder retains all rights, with a few specific exceptions as stated below. Shareware authors are accomplished programmers, just like commercial authors, and the programs are of comparable quality. (In both cases, there are good programs and bad ones!) The main difference is in the method of distribution. The author specifically grants the right to copy and distribute the software, either to all and sundry or to a specific group. For example, some authors require written permission before a commercial disk vendor may copy their Shareware.

Shareware is a distribution method, not a type of software. You should find software that suits your needs and pocketbook, whether it's commercial or Shareware. The Shareware system makes fitting your needs easier, because you can try before you buy. And because the overhead is low, prices are low also. Shareware has the ultimate money-back guarantee -- if you don't use the product, you don't pay for it.

DISCLAIMER - AGREEMENT

Users of Windows Enforcer must accept this disclaimer of warranty: "Windows Enforcer is supplied as is.  The author disclaims all warranties, expressed or implied, including, without limitation, the warranties of merchantability and of fitness for any purpose. The author assumes no liability for damages, direct or consequential, which may result from the use of Windows Enforcer."

Windows Enforcer (hereby known as "the software") is a "shareware program" and is provided at no charge to the user for evaluation.  The "shareware", unregistered, version of the software can be freely distributed, but it cannot be altered in any way or distributed as part of another system.  If you find the software useful, you must make a registration payment to Posum LLC to obtain a personalized registration number.  The registration fee for a single copy will license one copy of the software for use on any one computer at any one time.

Each license of the software purchased grants the licensed individual the privilege to use a single copy of the software.  Once a license is granted, it cannot be transferred to another individual.  The purchase of a license or licenses does not bestow the right to distribute, resell, or in any way disseminate registered versions of the software or registration numbers for the software.

After being approved, resellers may purchase licenses of the software for customers, but the licenses will be granted to the customers directly and not to the reseller.  Resellers are not granted rights to distribute, resell, or in any way disseminate registered versions of the software or registration numbers for the software except through specific purchasing agreements with Posum LLC.  See our reseller page at http://posum.com/reseller.html.

Anyone distributing the software for any kind of remuneration must first contact Posum LLC for authorization and the terms for distributing the software.

enfset.exe

enfrun.hlp

enfrun.exe

lockctrl.exe

tskutil.exe

tskutil.hlp

uninstall.exe

dsplyenf.exe

warning.exe

warning.txt

example1.etk

example2.etk

iexplore.etk

netscape.etk

Q1.etk

Q3.etk

Q4.etk

boom.wav

tada.wav

ding.wav

readme.txt

upgrade.txt

qstart.txt

license.txt

help.ico

Copyright (c) 2001  Posum LLC   http://posum.com


Add Task/Edit Task Dialog

The Add Task and the Edit Task dialog function in the same manner.  The Add Task starts with the defaults and the Edit Task with the settings of the task selected from the Task List on the main dialog.  If you want to prohibit the MS-DOS Prompt then special steps need to be taken to properly set the Properties.

Prohibit task:  This indicates that the specified task must never be allowed to run.  The Program Name is not required with this option.  It is possible to define user specified exceptions to a prohibited task.

Execute task:  This indicates that the specified task must always run.  The program name is required for this option.  Example 4 shows how this option is used.

Ignore task:  This indicates that Enforcer will ignore the specified task.  That is, the task is allowed to run, but the task is not required to run.  This option is useful when defining exceptions to a prohibited task or when the Prohibit all tasks except those specified option is checked.  Example 4 shows how this option is used.

Task Name:  Enter the name of the task you wish to enforce in this field. To select from a list of the currently running tasks use the Browse button.  Once the task name for the desired task is chosen, you may edit the task name to take advantage of the partial matching capability.  For more information on task name matching, follow this link.

Browse:  This button displays the Task Browser dialog.

Simply select the task you wish to enforce from the list box.  The task name will appear in the Selected Task field.  You may return this name as selected to the Task Definition dialog.  If some new tasks have started you may select Update to refresh the list box.  As always OK dismisses the dialog accepting the selected task and Cancel simply dismisses the dialog.

Program Name:  Enter the full path and filename of the executable you wish to always run.  This is not required if you have specified the task to never run or as an optional task.  If you do not know the exact path or name of the executable, then use the Browse button.  Under the Program Name, is a select list with two options: Run Normally or Maintain Maximum Window.  This selection indicates if the program should simply be executed in a normal manner or if it should always be kept as a maximized window.  When executed, this program must show up with a task name that will match the name specified in the Task Name field or multiple copies of the program may be executed.

Browse:  This button displays the Program Browser dialog.

The Program Browser is a standard file finder dialog.  Simply browse the drives and directories of your choice to find the desired file.  Select OK when you are done and the program name with a full path will appear in the Program Name field.

OK:  This button saves the changes and dismisses the dialog.

Cancel:  This button dismisses the dialog and does not save the changes.


Special Steps for Enforcing the MS-DOS Prompt and MS-DOS programs

To properly enforce the MS-DOS Prompt or an MS-DOS program, the Properties must be set a certain way.  Bring up the Properties dialog and select the Screen tab.  When the tab appears, select the Window radio button in the Usage section.  This insures that the MS-DOS Prompt will appear as a Window.  This is required for the Windows Enforcer to work properly on the MS-DOS prompt.  This step is not necessary for MS-DOS programs.

Next, select the Misc tab.  This step is necessary for both the MS-DOS prompt and MS-DOS programs.  Make sure the check box in the Termination section is NOT checked.  This insures a clean closure of the MS-DOS Prompt or MS-DOS program.

After this is done, add the MS-DOS Prompt Properties dialog as a task to Never Run to insure a user doesn’t reset them. This is done on the Add Task dialog.  Now you may add the MS-DOS prompt or your MS-DOS programs as tasks to be enforced.


Questions, Answers, and Examples

The following hypothetical questions cover a few generic applications of Windows Enforcer.  Combinations and/or variations on the procedures presented here should allow you to set up a system with the configuration control you desire.

Q1:  How do I prevent a user from executing a task using the RUN command or from messing up my task bar?

Q2: How do I set up a system to never allow the DOS prompt to run but still let anything else run?

Q3: How do I set up a system to always run my Demo App and nothing else?

Q4: How do I set up a public system to always run a specific app, allow any of three others to execute if necessary and always lock out anything else even if I don’t know what these other apps might be?

Q5:  How do I use Enforcer to child-proof my system?

Q6:  Why does Enforcer keep executing multiple copies of my app?

Q7: How do I disable CTRL+ALT+DEL?

Q8:  Why can’t I shutdown Windows  when Enforcer is running?

Q9: Why does Enforcer display my password whenever one is entered?  Why does the Enforcer dialog keep appearing every 10 minutes?

Q10: I have disabled my DOS apps/prompt and/or my Windows Update and I can't use them anymore.  How do I enable them again?

Q11: I need to disable the Windows key, how do I do it?

 Q12: Why does Enforcer (enfrun.exe) show up as a small window on my desktop when I start it before Windows login?

Q13: Enforcer is running, but there isn’t an icon in the system tray and I do not have a hot key defined.  How do I get to the dialog to type in my password and stop it?

Q14: How do I limit internet access to only the pages that have been approved?


Question 1
Q1:  How do I prevent a user from executing a task using the RUN command or from messing up my task bar?

A: The Taskbar Properties, Display Properties, and the Run commands are accessible from the task bar and as such are child windows of the task bar.  These may be added to the task list by manually typing in the titles of their dialogs (i.e. their task names) in the Task Name field of the Add Task dialog or by running them and using the Task Browser.  Make sure the Prohibit task selection is chosen for each of these.

When you return to the main dialog your task list should now contain Taskbar Properties, Display Properties, and Run.  The icon of the circle with a slash through it will be associated with each of these tasks.  Select OK and you are ready to run enfrun.exe so that these commands cannot execute while Enforcer is running.  The exact steps for doing this are as follows.  The results from these steps can be seen in the example file Q1.etk.

1) If enfrun.exe is running, stop it with the password and run enfset.exe

2) Press the Add Task button and the Add Task dialog will appear.

3) In the Task Name field, type in “Taskbar Properties” (without the quotes).

4) Make sure the “Prohibit task” radio button is checked then press OK.  This will return you to the main dialog of enfset.exe and “Taskbar Properties” will show up in your Task List with the icon of a circle with a slash through it.

5) Press the Add Task button and the Add Task dialog will appear.

6) In the Task Name field, type in “Display Properties” (without the quotes).

7) Make sure the “Prohibit task” radio button is checked then press OK.  This will return you to the main dialog of enfset.exe and “Taskbar Properties” and “Display Properties” will show up in your Task List with the appropriate icon.

8) Press the Add Task button and the Add Task dialog will appear.

9) In the Task Name field, type in “Run” (without the quotes).

10) Make sure the “Prohibit task” radio button is checked then press OK.  This will return you to the main dialog of enfset.exe and “Taskbar Properties”, “Display Properties”, and “Run” will all show up in your Task List with the same icon.

11) Since all this example does is make sure some tasks do not run, make sure the Options -> Prohibit all tasks except those specified menu item IS NOT checked.

12) Define a password you haven’t already

13) Press OK to exit enfset.exe and save the changes.

14) Run enfrun.exe.


Question 2
Q2: How do I set up a system to never allow the DOS prompt to run but still let anything else run?

A:  If you want to disable the DOS prompt and any DOS apps then it is quite simple.  Just run enfset.exe and choose the “Options->Disable MS_DOS prompt and DOS apps” selection.  This is only available for Windows 95/98 systems.  See the example below for another approach that works for Windows.  Now select OK to save the settings.  This will disable the DOS prompt and any DOS apps while enfrun.exe is running.  Just a note, you will need at least one task defined for Enforcer to run.

If you want just the DOS prompt disabled and still allow other DOS apps to run, it is a little more involved.  If enfrun.exe is running, stop it using your password.  Set your DOS prompt’s properties as described in the Special Steps for Enforcing the MS-DOS Prompt .  When this has been done, bring up your DOS Prompt and keep it running.

Now run enfset.exe.  If any tasks are defined then delete them.  Look at the Options -> Prohibit all tasks except those specified menu item and make sure it is NOT checked.  You are now ready to add the DOS Prompt as a task.  Select the Add Task button to bring up the Add Task dialog.  Select the Browse button at the end of the Task Name field to bring up the Task Browser dialog.  Select the DOS Prompt task from the list box and select OK.  Make sure the Prohibit task selection is chosen and then select OK.  On the main dialog, your task list should contain only a DOS Prompt entry with the icon of a circle with a slash through it.  Select OK and you are ready to run enfrun.exe to never allow the DOS Prompt to run but still let anything else run. The exact steps for doing this are as follows:

1) If enfrun.exe is running, stop it with the password.

2) Set your DOS prompt’s properties as described in the Special Steps for Enforcing the MS-DOS Prompt and bring up a DOS prompt and keep it running.

3) Run enfset.exe and press the Add Task button.  The Add Task dialog will appear.

4) Press the Browse button at the end of the Task name field.  From the Task Browser dialog select the task name that goes with the DOS prompt and press OK to return to the Add Task dialog.

5) Make sure the “Prohibit task” radio button is chosen then press OK.  This will return you to the main dialog of enfset.exe and the task name for the DOS prompt will show up in your Task List with the appropriate icon (circle with a slash).

6) Since all this example does is make sure the DOS prompt does not run, make sure the Options -> Prohibit all tasks except those specified menu item IS NOT checked.

7) Define a password you haven’t already

8) Press OK to exit enfset.exe and save the changes.

9) Run enfrun.exe.


Question 3
Q3: How do I set up a system to always run my Demo App and nothing else?

A:  If enfrun.exe is running, stop it using your password.  Start your Demo App (we’ll use Notepad for this example) and then run enfset.exe.  If any tasks are defined then delete them.  Look at the Options -> Prohibit all tasks except those specified menu item and make sure it IS checked.

You are now ready to add your Demo App (Notepad) as a task.  Select the Add Task button to bring up the Add Task dialog.  Select the Browse button at the end of the Task Name field to bring up the Task Browser dialog.  Select your Demo App (Notepad) task from the list box and select OK.  Edit out the document name so that the task is defined simply as Notepad.  Make sure the Execute task selection is chosen.  Fill in the Program Name field with the name of your Demo App’s executable (notepad.exe) and choose how you would like it to run from the list below this field. Choose the Maintain Maximum Window option from the dropdown list.  Now, select OK.  On the main dialog, your task list should contain only the Notepad entry with an icon of a circle with an ‘R’ in it.

Some tasks must be specifically added to your task list for them to not execute.  The Run, Display Properties, and Taskbar Properties commands are examples of this. To make sure a user does not reconfigure your system, add these tasks as detailed in the first question of this section.  When you return to the main dialog your task list should now contain your Notepad, Run, Display Properties, and Taskbar Properties.  Select OK and you are ready to run enfrun.exe to always run your Demo App and nothing else. The exact steps for doing this are as follows.  The results of these steps or in the task file Q3.etk.

1) If enfrun.exe is running, stop it with the password and run your Demo App (Notepad).

2) Run enfset.exe, press the Add Task button and the Add Task dialog will appear.

3) Press the Browse button at the end of the Task name field.  From the Task Browser dialog select the task name that goes with your Demo App (Notepad) and press OK to return to the Add Task dialog.  Now edit out the document name so that the task is defined just as Notepad.

4) Make sure the “Execute task” radio button is chosen.  This will enable the Program Name field.

5) Press the Browse button at the end of the Program Name field.  Locate the executable for your Demo App (notepad.exe) and press open to return to the Add Task dialog.

6) Now chose how to execute your Demo App from the list below the Program Name field.  You can either run your Demo App as a normal window or choose to maintain your Demo App as a maximized window while it is running.  Choose the Maintain maximized window option for this example.

7) Now chose OK on the Add Task dialog to return you to the main dialog.  The task name Notepad will appear in the task list with an icon of a circle with an R inside it.

8) Since this example is to insure that your Demo App (Notepad) always runs and nothing else does, make sure the Options -> Prohibit all tasks except those specified menu item IS checked.

9) To insure that curious users do not reconfigure your system, define the system tasks Run, Display Properties, and Taskbar Properties as tasks to never run as shown in question #1.  These are special cases and must be specifically defined since they are child windows of the taskbar and the Windows operating system.

10) Define a password you haven’t already

11) Press OK to exit enfset.exe and save the changes.

12) Run enfrun.exe.


Question 4
Q4: How do I set up a public system to always run a specific app, allow any of two others apps to execute if desired and always lock out anything else even if I don’t know what the other apps might be?

A:  Set up your task list using enfset.exe as described in the question #3.  This will set up Windows Enforcer to always run your specified application (Notepad in this case) and prevent all others from executing.  Now, Add the two optional tasks using the Add Task dialog.  Make sure the Ignore task selection is chosen for each of the two optional applications.  When you return to the main dialog your task list should now contain your specified application, Run, Taskbar Properties, Display Properties, and your two optional tasks.  Select OK and you are ready to run enfrun.exe to always run your specific app, optionally run your other three and nothing else.

The task file Q4.etk has the results of this process using Notepad, Solitaire, and Minesweeper.  This example is closely related to Example #2 in the Task Definition Utility helpfile.  Working through the two examples and comparing them is recommended.


Question 5
Q5:  How do I use Enforcer to child-proof my system?

A:  This is simply a variation on the steps we have taken in previous questions.  Add the tasks you wish your child to have access to as “Ignore task” and make sure the Options -> Prohibit all tasks except those specified menu item IS checked. When this is complete, set up Windows to execute enfrun.exe as detailed in the Security hints and tips section.  This will start Enforcer as Windows comes up and only allow access to the tasks you defined.  The exact steps are as follows.  Example #2 in the Task Definition Utility is an example of an easier way of accomplishing this.  The use of the Task Definition Utility is highly recommended in this case.

1) If enfrun.exe is running, stop it with the password and run the applications you wish your child to have access too.  If the number of applications is too large to do this, then simply do a few at a time. Run enfset.exe.

2) Press the Add Task button and the Add Task dialog will appear.

3) Press the Browse button at the end of the Task name field.  From the Task Browser dialog select the task name that goes with one of the applications you wish your child to have access to and press OK to return to the Add Task dialog.

4) Make sure the “Task Execution Optional” radio button is checked.

5) Now chose OK on the Add Task dialog to return you to the main dialog.  The task name for the selected application will appear in the task list.  If you have other applications to add go back to step 2 and continue until you are done.

6) Since this example is to insure that only specific applications (tasks) can run, make sure the Options -> Prohibit all tasks except those specified menu item IS checked.

7) To insure that curious users do not reconfigure your system, define the system tasks Run, Display Properties, and Taskbar Properties as tasks to never run as shown in question #1.  These are special cases and must be specifically defined since they are child windows of the taskbar and the Windows operating system.

8) Define a password you haven’t already

9) Press OK to exit enfset.exe and save the changes.

10) Run enfrun.exe.

When you wish to disable the child-proofing, simply bring up the enfrun.exe dialog and type in your password.  Now you have complete access to your system.  If you wish to be able to child-proof on demand, them setup a shortcut to enfrun.exe.  This will allow optional child-proofing with a single selection.


Question 6
Q6:  Why does Enforcer keep executing multiple copies of my app?

A:  If a task is defined to always run and the task name in the field does not match with the task name of the specified program, then multiple copies of this program will be executed.  This happens because Enforcer can’t ever find the specified task running so it executes the specified program.  An example of this is as follows.

You want to always execute “Notepad” so you define a task name of “Noetpad” and define the program file as “c:\windows\notepad.exe”.  Notice the task name is mis-spelled.  When Enforcer executes, it will look for the task “Noetpad”.  It will not find it so it will execute “c:\windows\notepad.exe”.  The next time it looks, it still will not find “Noetpad” so it will execute “c:\windows\notepad.exe” again.

To fix this, make sure the task name you specify matches the task name of the program you define.

If the task name and the program name match and you still get a limited number of multiple executions then you have a timing problem.  This can happen if an application takes a few seconds to initialize.  This is common with applications started from a CD-ROM.  To get around this problem a command line argument can be specified to delay program execution.


Question 7
Q7:  How do I disable CTRL+ALT+DEL?

A:  By default, Enforcer does not disable CTRL+ALT+DEL on Windows 95 or 98 except when the dialog associated with enfrun.exe is displayed.  ALT+TAB is disabled as a side effect of this. To insure that CTRL+ALT+DEL is disabled whenever Enforcer is running, you can check the Always disable Ctrl+Alt+Del option.  Enforcer will protect itself against undesired termination even without disabling CTRL+ALT+DEL.

This is only a feature on Windows 95 or 98.


Question 8
Q8:  Why can’t I shutdown Windows  when Enforcer is running?

A:  By default, Enforcer disables Windows shutdown.  This is done to make your system more secure.  Windows Shutdown will be enabled when Enforcer is properly exited using the password.  If you require the use of Windows Shutdown while Enforcer is running then you can uncheck the “Options->Disable Windows shutdown” in the setup, enfset.exe, to allow it.


Question 9
Q9: Why does Enforcer display my password whenever one is entered?  Why does the Enforcer dialog keep appearing every 10 minutes?

A: Enforcer only displays the password for unregistered copies.  Enforcer will also display the dialog once every 10 minutes if you are unregistered and you are using Stealth Mode.  Once you register your copy of Enforcer with us at Posum (http://posum.com), the password will no longer be displayed.  The password is displayed on unregistered copies to allow users to fully evaluate the software without getting the security benefit therefore encouraging registration.


Event Sounds Dialog (WAV files)

The Event Sounds dialog allows the user to specify WAV files to be played when Enforcer starts up, when a prohibited task is kept from running, or when a bad password is entered.

Startup WAV file:  This field contains the filename of the WAV file that will be played when Enforcer starts.  The check box to the left of this field indicates if the specified file should be played (checked) or not played (unchecked) for this event.  If you do not know the filename or specific location, choose the Browse button to the right of this field.

Preview Startup WAV:  This button will play the WAV files specified in the Startup WAV file field.  If this button is not active then the check box is not checked and/or the specified WAV file can’t be found.

Task Termination WAV file:  This field contains the filename of the WAV file that will be played when Enforcer stops a prohibited task from running.  The check box to the left of this field indicates if the specified file should be played (checked) or not played (unchecked) for this event.  If you do not know the filename or specific location, choose the Browse button to the right of this field.

Preview Task Termination WAV:  This button will play the WAV files specified in the Task Termination WAV file field.  If this button is not active then the check box is not checked and/or the specified WAV file can’t be found.

Incorrect Password WAV file:  This field contains the filename of the WAV file that will be played when Enforcer is given an incorrect password.  The check box to the left of this field indicates if the specified file should be played (checked) or not played (unchecked) for this event.  If you do not know the filename or specific location, choose the Browse button to the right of this field.

Preview Incorrect Password WAV:  This button will play the WAV files specified in the Incorrect Password WAV file field.  If this button is not active then the check box is not checked and/or the specified WAV file can’t be found.

OK:  This button saves the changes and dismisses the dialog.

Cancel:  This button dismisses the dialog and does not save the changes.


Command Line Arguments at Runtime

These command line arguments are provided to increase the flexibility of Windows Enforcer.  When Enforcer is run without these command line arguments, it is the most secure.  The defaults (no command line arguments) are as follows.  We recommend running Enforcer without any command line arguments unless it is necessary for your particular situation.

- Partial task name matching enabled

- No delay in task checking

- Do not disable CTRL+ALT+DEL

- Do not exit Windows on improper termination of Enforcer

To use multiple command line arguments, simply combine them into a single argument.  An example is as follows.

enfrun.exe -xd5e

-x : to require an exact match of task names

For certain specific applications of Enforcer, the exact matching of task names is necessary.  Using this command line argument will stop partial task name matching.

-d# : to specify a delay between task execution and checking, # is the number of seconds

To specify an execution delay for applications that take a few seconds to execute, like those from a  CD-ROM.  This delay is in seconds and can only be a positive number.  A negative number or non-numeric character will be treated as if the argument was not specified.  There is no upper limit on the duration of the delay but only set it for the delay you need.  A very long delay can degrade the security of your system. This command line argument prevents applications that are slow to initialize from being executed multiple times.

-e : to exit Windows in case of improper termination of Enforcer

This option will exit Windows and shutdown your system if an attempt is made to terminate Enforcer without the password being used.  This command line option is not recommended for slower systems because of asynchronous timing issues.  If you need to use this option, test it thoroughly to insure that it will perform properly on your system.

-t# : delay between task detection and task termination (in seconds)

The delay, in seconds, determines the length of the pause between a task's detection and it's termination. This is useful for programs that need to fully initialize so they can be terminated correctly. The delay is in seconds with the default being 0 (zero) or no delay (same as -t# not used).

-m : require exact matching on exception tasks

This is provided primarily to insure that the behavior on exception matching seen in version 6.0 can also be found in version 6.1.  If you defined some exceptions to must never run tasks in version 6.0 and they do not behave correctly in version 6.1, then try this option.

As previously stated, to use multiple command line arguments, simply combine them into a single argument.  An example is as follows.

enfrun.exe -xd5e

This specifies exact matching of file names, allow executed applications a 5 second delay before Enforcer checks for them, and shutdown the system if Enforcer is terminated without the password.

If you need to specify command line arguments in the startup menu or in a shortcut then you must specify the command line as follows on the shortcut tab of the properties dialog.

The trick is to enclose the program name and path in double quotes and place the command line arguments outside the quotes.  An example is:

"C:\Program Files\Posum\Enforcer\enfrun.exe" -xd5e


Posum's order form
Posum’s order form

Please print the following order form, fill it out and send it along with your registration fee or credit card information to the following address.  We accept US and international credit card orders by fax, postal mail, or online.

Posum LLC

PO Box 21015

Huntsville, AL 35824

USA

For a fax number and the latest ordering information visit out web site at http://posum.com

Last Name: _____________________First Name: __________________MI:_______

Address 1:____________________________________________________________

Address 2:____________________________________________________________

City: __________________________State or Province:________________________

Country: _______________________Zip (postal) code:________________________

Complete Phone No.:___________________________________________________

Complete Fax No.:___________________________________________________

Email address:_________________________________________________________

Payment method:

___Check or money order (must be in US dollars on a US or Canadian bank;

        payable to Posum, LLC)

___ VISA, ___Master Card, ___American Express, ____ Discover

Card Number:________________________________ Expiration Date:____________

I agree for the merchant, Posum, LLC, to charge the amount listed below to my card.

_________________________________________________________

Signature of card holder

Select the Desired Product(s) (costs are in US dollars)

Windows 95/98/Me/NT/2000 products	Cost	Quantity	Amount
___ Windows Task-Lock (single system)	$9.95	______	______
___ Windows Enforcer (single system)	$9.95	______	______
___ ClipboardClear (single system)	$5.00	______	______
___ WorkStation Lock (single system)	$5.00	______	______
___ Execute Screen Saver Utility (single system)	$5.00	______	______
Special order description
______________________________________
______________________________________	______	______	______
		Total:	______


Important Note for NT/2000 Users

The Task Manager for Windows NT/2000 is a much more capable program than it's equivalent in Windows 95/98/Me.  For this reason, the extra step of protecting access to the Task Manager must be taken to use Enforcer securely on Windows NT or Windows 2000.  The following are very simple but vitally important steps.

The Task Manager dialog will have a title as follows:

Follow these steps to secure access to the Task Manager.

1) Run the Task Manager.  This can be done by pressing CTRL+ALT+DEL and choosing the Task Manager button that appears on the dialog.

2) Run enfset.exe.

3) Press the Add Task button.  From the Add Task dialog press the Browse button and choose the task name for the Task Manager.  This task name is "Windows NT Task Manager" (no quotes of course) for Windows NT 4.0.  Select OK on the Browse dialog.  Now select the “Task Must Never Run” radio button.

4) Select OK on the Add Task dialog and OK on the main dialog to save your changes.

Once this is done, Windows Enforcer will prevent the Task Manager from running unless the user has the password to stop the execution of Enforcer.

If you wish to totally disable the Task Manager, create the following system key if it is not already present.

WARNING: This requires modification of the registry.  If you are not familiar with modifying the registry, have someone who is more knowledgeable assist you.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion

\Policies\System

The system key is a single path.  It was wrapped for readability.

Add the following value of the specified type.

Value:  DisableTaskMgr

Type:  REG_DWORD

Options:  1=Enable, 0=disable


Task names and task name matching

The task name is usually the same as the text displayed as the window title.  You do not have to enter the whole title.  The comparison will be done only on the portion you enter.  For example, if you enter Notepad as the task name the enforcement software will enforce (Untitled) - Notepad or mytext.txt - Notepad.  This is an example of task name matching at the end.  If you enter File Man as the task name, the enforcement software will enforce File Manager.  This is an example of task name matching at the beginning.  The software will not enforce a task that has its name defined as a sub string interior to the task name.  For example, Man entered as a task name WILL NOT result in the enforcement of File Manager.


User Specified exceptions to a prohibited task

This is best explained with an example.  Suppose a user wishes to prevent everything with "Setup" in the task name from running, except a few choice tasks such as "Page Setup" and "Printer Setup".  Define a task called "Setup" to never run.  This task will be defined with the “Prohibit task” option chosen on the Add Task dialog.  Then define tasks called "Page Setup" and "Printer Setup" respectively and define them to be ignored.  To define a task to be ignored, select the “Ignore task” option on the Add Task dialog.  This will make "Page Setup" and "Printer Setup" exceptions to the prohibited task: "Setup".

All tasks that match "Setup" will be terminated except for “Page Setup” and “Printer Setup”.


Secure Desktop Wallpaper

This option will allow you to secure your desktop wallpaper against any tampering.  Applications such as Netscape and Internet Explorer allow the user to save images as wallpaper.  By using this option, you can insure that only the wallpaper you want is displayed.

Secure Desktop Wallpaper: Checking this box will cause Enforcer to make sure that your wallpaper is always the specified bitmap file or that no wallpaper is allowed (None).

Delay: The value in this field gives the time interval (in seconds) in which the wallpaper is checked and reset if necessary.  This value can be as small as 1 second or as much as an hour (3600 seconds).

Wallpaper: This field specifies the wallpaper you wish to be displayed.  You may choose one of the bitmaps listed in the pulldown portion or (None).  Choosing (None) will insure that no wallpaper is allowed.  If the file you want is not in the pulldown list, you may use the Browse button to locate a file of your choice.

The wallpaper chosen will display either tiled or centered depending on the settings on the Background tab of the Display Properties dialog.


Hot Key

The Hot Key dialog allows you to set a "Hot Key" that can be used to gain quick access to the Enforcer dialog associated with enfrun.exe.  By using the sequence of keys defined by this dialog, the password dialog will appear, assuming enfrun.exe is running, no matter what application has the focus.  The Hot Key is required when running in Stealth Mode.

Use Hot Key:  This option allows you to use the defined Hot Key (checked) or not use the defined Hot Key (unchecked).

CTRL+ALT+__ : This field allows you to select the desired Hot Key.  The first two keys will always be the CTRL and ALT.  You may select the third key from the given list.  The letters A-Z may be used for the Hot Key.  Only upper case letters are shown.  Case is not used for Hot Key detection.  For example, if you choose an "E" as the Hot Key, then pressing the sequence "CTRL+ALT+E" (all three keys at once) will display the Enforcer dialog associated with the enfrun.exe executable.


Stealth Mode

The status of this menu item indicates if Stealth Mode is active (checked) or not (unchecked).  Stealth Mode runs Enforcer, enfrun.exe, without placing an icon in the system tray.  It is required that a Hot Key be defined when using Stealth Mode.  The Hot Key allows easy access to the Enforcer dialog with a simple set of keystrokes and does not require the icon in the system tray.

Stealth Mode does not disable Events Sounds.  If you wish silent operation also, the Event Sounds must be turned off manually.


Administrator Password

The Administrator Password dialog defines or changes the password that allows an administrator to dismiss Enforcer, enfrun.exe.  This feature is only available when a site license has been registered.  It is not active for a single system registration.

Old Password:  This field accepts the current administrator password, if one exists, prior to a change.

New Password:  This field accepts the new or changed administrator password.

Confirm:  This field accepts the new administrator password again as a confirmation that it was typed correctly.

OK:  This button saves the changes and dismisses the dialog.

Cancel:  This button dismisses the dialog and does not save the changes.


Change user's password
Change User’s Password

The Change user’s password dialog changes the password that halts the execution of the Enforcer, enfrun.exe. This will allow the administrator to change the user’s password without having to know their current one.  These functions require the Administrator Password so they are only available to site license registrations.

Administrator Password:  This field accepts the current Administrator Password.

New Password:  This field accepts the changed password.

Confirm:  This field accepts the new password again as a confirmation that it was typed correctly.

OK:  This button saves the changes and dismisses the dialog.

Cancel:  This button dismisses the dialog and does not save the changes.


Our other products

You can see all the latest releases of our products and get the latest ordering information on our website at http://posum.com.  We now accept credit card orders by fax, postal mail, or on our secure online ordering page (http//posum.com/ordering.html).

Here is a summary of our products and a few of their capabilities.  For a more extensive description of these products and the latest information, please visit our website.

For Windows 95/98/Me/NT/2000....

Windows Task-Lock (http://posum.com/tasklock.html) provides a simple and inexpensive, but effective way to password protect specified applications for Windows 95/98/Me or NT/2000 no matter how they are executed. It is easy to configure and requires little to no modifications to your current system configuration. Administrator functions are enabled for site licenses.

Features and options:

•	User specified sound events for notification of user activity.

•	Runs from the system tray or in the background in stealth mode.

•	User specified time limit for typing passwords.

•	Administrator functions for site administration.

•	Online help.

WorkStation Lock (http://posum.com/worklock.html) provides a simple and inexpensive, but effective way to password protect your system at startup or quickly from a desktop shortcut or the system tray without involving a screen saver. It is easy to configure and requires no modifications to your current system configuration. Administrator functions are enabled for site licenses.

0	Features and options:

•	Disable CTRL+ALT+DEL (Win95/98/Me only).

•	Locking activation after a specified period of inactivity independent of your screen saver.

•	Easily accessible from the system tray.

•	Screen blanking for greater privacy when system locked.

•	User selected position of locking dialog or random movement.

•	Administrator functions and remote update capability for site administration.

•	Online help.

Execute Screen Saver Utility allows you to configure your favorite screen saver to not only save your screen and entertain you, but to perform whatever useful tasks you desire. Now you can execute multiple programs when your screen saver is activated. This means your screen saver event can execute a security program, system utility, or any other programs of your choice.


Log File

The Log File dialog allows you to record the activity associated with Enforcer (enfrun.exe) while it is protecting your system.

Log Activity to File:  This option specifies if you wish to log the events associated with Enforcer (enfrun.exe) to the specified file.

Append to File:  This option specifies if you wish each new execution of Enforcer (enfrun.exe) to append the information to the specified file (checked) or create a new file (unchecked).  Any attempt at illegal termination of Enforcer (enfrun.exe) will result in an append to the specified file.  A new file will only be created if this option is not checked and Enforcer (enfrun.exe) is executed correctly after a proper exit.

Date format:  This dropdown list allows you to choose the format of the date recorded in the logfile.  You can specify month, day, year (MM/DD/YY), day, month, year (DD/MM/YY), or year, month, day (YY/MM/DD).

Time format:  This dropdown list allows you to choose the format of the time recorded in the logfile.  You can specify 24-hour military time or 12 hour time.

Log File:  This is the file on disk that you wish to write information.

OK:  This button saves the changes and dismisses the dialog.

Cancel:  This button dismisses the dialog and does not save the changes.

The following events are logged along with their time to the specified file on disk.

Event	Information logged
Start of Enforcer (enfrun.exe)	Time
Entering a bad password	Bad password and time
Entering a good password to terminate Enforcer (enfrun.exe)	Time
Termination of a prohibited task	Prohibited task and time
Attempted illegal termination of Enforcer (enfrun.exe)	Time

Note to Novell users

You can now log which user is using Enforcer by adding the following line to your login script.

‘DOS Set User= “%Login_name”’

Enforcer will look for the environment variable User when it starts.  If Enforcer finds the environment variable User, it will log it to the specified logfile and you can keep up with each users activity.


Question 10
Q10: I have disabled my DOS apps/prompt and/or my Windows Update and I can't use them anymore.  How do I enable them again?

A: If Enforcer is still running, stop it using your password.  This should restore your ability to use your DOS apps/prompt and/or Windows Update.  If for some reason they are still disabled after you stop Enforcer, you will have to manually reset them using the registry editor (regedit.exe).  This only applies to Windows 95/98.  Here are the steps.

1) Stop Enforcer (enfrun.exe) with the password.

2) Run the registry editor (regedit.exe)

3) Locate the following key for the DOS apps/prompt.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp

4) Delete this key and anything underneath it.  This will restore your DOS capability.

5) Locate the following key for Windows Update.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

6) Delete the entry called “NoWindowsUpdate” under this key.  This will restore Windows update.


Start Enforcer at Windows startup

This dialog allows you to easily add Enforcer to the registry so that it will execute as soon as Windows starts. Do not set your registry until you are satisfied with the password and tasks you have defined.

A valid user or administrator password must be entered first before this functionality can be used.

On Windows 95/98/Me, it can designate Enforcer to run as a service so that it will start even before a user logs on. This prevents someone from getting around Enforcer through Windows Login.  To run Enforcer only after the Windows Login, use the Run key.

On Windows NT/2000, the logon procedure is more secure so this is not necessary.  Enforcer will be started using only the Run registry key.

If for some reason you need to remove Enforcer from your registry, an option for this is provided.

Run from system registry before Windows Login (RunServices key): This option will add Enforcer (enfrun.exe) to the registry so that it will execute as Windows starts before the Windows login. This entry is not used on NT/2000.

Remove entry to run before Windows login (RunServices key): This option will remove Enforcer (enfrun.exe) from the RunServices registry key of the system registry. This registry key executes enfrun.exe when the system comes up before the user logs on, if multi-user logon is being used. If multi-user logon is not being used, it will simply execute enfrun.exe as Windows comes up.  This entry is not used on NT/2000.

Run from system registry after Windows Login (Run key): This option will add Enforcer (enfrun.exe) to the registry so that it will execute as Windows starts but only after Windows login.

Remove entry to run after Windows login (Run key): This option will remove Enforcer (enfrun.exe) from the Run registry key of the system registry. This registry key executes enfrun.exe when the system comes up after the user logs on, if multi-user logon is being used. If multi-user logon is not being used, it will simply execute enfrun.exe as Windows comes up.

Password: Enter the user or administrator password in this field to enable the dialog.

Location of enfrun.exe: Type or use the Browse button to specify the location on your hard disk where the executable enfrun.exe is located.

Optional command line parameters:  Specify any command line parameters you require for enfrun.exe in this field.

Set Registry: This button will either add Enforcer to the registry or remove it depending on the option you have selected.


Question 11
Q11: I need to disable the Windows key, how do I do it?

A: To insure that the Windows key is disabled on Windows 95/98/Me whenever Enforcer is running, you can check the Always disable Ctrl+Alt+Del option to disable it.


Question 12
Q12: Why does Enforcer (enfrun.exe) show up as a small window on my desktop when I start it before Windows login?

A:  When you execute Enforcer (enfrun.exe) on Windows 95/98/Me before Windows login, it is started using the RunServices registry key.  This starts Enforcer (enfrun.exe) as a service and it shows up as a small window on your desktop.

To prevent this from happening, select a Hot Key of your choice and turn on the Stealth Mode option.  This will hide Enforcer from view and remove the small window from your desktop.


Warning message

The warning message dialog let you specify an external ASCII text file that contains a customized warning message.  This message will be displayed whenever Enforcer closes a prohibited task.  You may specify an existing external ASCII file or you may specify a new filename and your desired text to create your own.

Use warning message:  Check this box if you wish to have the text from the specified file displayed when a prohibited task is closed.  If you do not wish to display the message from the specified file, then uncheck this box.

Warning message filename:  This field contains the name of the external ASCII file that contains the desired warning message.  You may specify an existing file by typing in the filename or by using the Browse button.  If you wish to create a new file, then just type in a new filename and the desired message in the Warning message field.  This file will be created when OK is pressed.

Warning message:  This field contains the ASCII text from the specified file.  You may edit this text and the edits will be saved when OK is pressed.

OK:  This button saves the changes and dismisses the dialog.

Cancel:  This button dismisses the dialog and does not save the changes.


Open Enforcer task file/Save as Enforcer task file

A task file contains a list of defined tasks.  These files have an .etk extension.  A few are delivered with the product as companions to the examples in the Questions, Answers, and Examples section of this helpfile and the examples in the Task Definition Utility  helpfile.

The Open Enforcer task file command allows you to select a previously saved task file and add it to your current task list.  You may either append the tasks from your selected file to the existing tasks in setup, or you may replace the existing tasks in setup with the tasks from the file.  Watch the prompts carefully, so you do not overwrite any tasks you wish to keep.

The Save as Enforcer task file command allows you to save the tasks you have defined in setup to a task file of your choice.  Once you get a set of tasks defined that provide the security you need, we recommend that you save these tasks to a task file.  This way, you can always restore a good configuration if necessary.


Prohibit all tasks except those specified

This command is a toggle on the Options menu in setup.

If the menu item is checked, Enforcer will only allow tasks to run that are defined to execute or that are defined to be ignored.  Any other tasks that are detected will be closed.  Checking this option will prohibit any task that you do not specifically define as allowed to run.  That is, if a task is detected that Enforcer doesn’t recognize, the task is closed.  This provides the tightest control over what can be executed on your system.

If the menu item is not checked, Enforcer will allow anything to run except those tasks that are defined as prohibited tasks.  By not checking this option, you choose to only prohibit a specific set of tasks that you define.  That is, if Enforcer detects a task that it doesn’t recognize, the task is allowed to run.


Allow Windows logoff

This command is a toggle on the options menu in setup.  This command is not available on NT or Windows 2000.

If the menu item is checked, then the user will be allowed to logoff of the current Windows session using a menu item on the Enforcer password dialog (enfrun.exe).  This menu item is accessible by clicking on the lock icon in the top left corner of Enforcer’s password dialog.

If the menu item is not checked, then the Logoff Windows menu item is not available on Enforcer’s password dialog.

The “Allow Windows logoff” command and the “Disable Windows shutdown” command cannot be checked at the same time.  In order to allow a user to logoff and disable shutdown, a combination of steps need to be taken.

To allow logoff and prohibit shutdown

1) Check the Options->Allow Windows logoff menu item in setup.

2) Check the Options->Always disable Ctrl+Alt+Del.

3) Add the task “Shut Down Windows” (no quotes of course) as a prohibited task.


Disable Windows shutdown

This command is a toggle on the options menu in setup.

If this menu item is checked, Enforcer will prevent the user from shutting down, restarting, or logging off of Windows.  This option will not enable Enforcer to prevent a forced shutdown.

If this menu item is not checked, Enforcer will allow the user to shutdown, restart, or logoff Windows.


Never/Always disable Ctrl+Alt+Del

These commands are toggles on the options menu in setup.  These options are only valid when running on Windows 95/98/Me.  They are not available for NT or Windows 2000.

Only one of these options can be checked at a time.  You may choose to never disable Ctrl+Alt+Del by checking the “Never disable Ctrl+Alt+Del” entry or you may choose to always disable Ctrl+Alt+Del by checking the “Always disable Ctrl+Alt+Del” entry.


Disable Registry editing tools, Disable Windows Update, Disable MSDOS prompt

These commands are toggles on the options menu in setup.  The “Disable Windows Update” and “Disable MSDOS” options are only valid when running on Windows 95/98/Me.  They are not available for NT or Windows 2000.  If you wish to disable the DOS window and DOS apps on NT, you will have to define them as you would any other task.

If the “Disable registry editing tools” menu item is checked, the registry editors that are delivered with Windows will be prohibited.  This option will not prevent other applications from using the registry.  It will only prohibit the registry editors delivered with Windows.

If the “Disable Windows Update” menu item is checked, the use of Windows Update will be disabled.  If this option is not checked, Windows Update will be available.

If the “Disable MSDOS” menu item is checked, the MSDOS window and DOS applications will be prohibited from running.  If this menu item is not checked, then the MSDOS window and DOS applications will be allowed to run unless they are prohibited through a defined task.


Task Definition Utility

Selecting this menu item will start the Task Definition Utility.  This utility is a very helpful tool when defining tasks.  In order to become familiar with the Task Definition Utility, please read through the Task Definition Utility’s helpfile and work through the examples that are provided.


Site Licenses

Site licenses are granted to companies, schools, and other organizations that require the protection provided by our software on multiple user systems that are administered by a single individual or group.  The difference between a site license and an individual license is the administrator functions.  The administrator functions are necessary for the efficient administration of many systems by a single individual or group, but are unnecessary for individual users.

The administrator functions are those found under the Administrator menu item in setup.

Site licenses are available at a discount.  If you are interested in a multi-system site license, first visit our site license request page at https://posum.com/sitequot.html and fill in the form and submit it.  Once we receive it, we’ll quote you a price.


Server licenses

Enforcer can be executed from a server with the proper registration.  This capability is not enabled in shareware version of the product.

If you are interested in purchasing a server license, please submit a site licenses request from our website at https://posum.com/sitequot.html.  In the comments section, please indicate that you are interested in a server license.  We will need the number of servers that you require licenses for and the overall number of clients that you expect to run the software.

We will provide you with the technical details of setting up a client/server installation of Enforcer at the time the quote is given.


Hide desktop

This command is a toggle and is only available to registered site licenses.  If the state of this toggle is changed, it will require a reboot before this change is reflected by the system.

A change in the state of this menu item must be detected before any change to the desktop is made.  That is, if the state of the menu item is checked when setup comes up, then it must be unchecked before a change in the desktop is seen.

If this menu item is checked, all the shortcuts on the desktop will be hidden and the right mouse menu for the desktop will be disabled.  If this menu item is not checked, then the desktop behaves in its normal manner.


Delete tasks

To delete a task or tasks from the task list, you may use the Delete task(s) button on the main form, the Tasks->Delete Task(s) menu item, or the Ctrl+D accelerator key.  These items will only be enabled it a task or tasks is chosen from the task list.


Configure Enforcer so that it executes as soon as Windows starts

You should configure Enforcer (enfrun.exe) so that it executes as soon as Windows starts.  There are three alternatives shown below to starting Enforcer as Windows starts up.  The first one is the easiest and most secure.

1) Add Enforcer to your registry.  This is accomplished using the Start Enforcer at Windows startup.  You can find this under the Options->Start Enforcer at Windows startup menu item in Enforcer Setup (enfset.exe).  This option is the easiest and most secure method for starting Enforcer at Windows startup.

2) Place the programs lockctrl.exe and enfrun.exe in your startup folder so that they executes as soon as Windows starts.  This option is the easiest for someone to get around.

To execute enfrun.exe at startup, the following command line should be used in the definition of the shortcut.  This is just an example; you will have to change the folder location of the executables to match where you installed Enforcer on your system.  The use of lockctrl.exe is not required for a desktop shortcut, only in the startup folder.

c:\Enforcer\lockctrl.exe c:\Enforcer\enfrun.exe

An executable named lockctrl.exe is provided with Enforcer.  This executable should be used to start enfrun.exe at Windows startup on Windows 95/98 systems to insure greater security.  This is handled automatically by option #1 above.  The syntax for using this executable is detailed below.  The use of lockctrl.exe is not required when defining a shortcut on your desktop.

The function of lockctrl.exe is to disable CTRL+ALT+DEL on Windows 95/98/Me systems and then load the program specified on the command line, enfrun.exe.  It will not disable CTRL+ALT+DEL on Windows NT/2000.  If you run lockctrl.exe without a command line argument, it will simply disable CTRL+ALT+DEL and exit.  To enable CTRL+ALT+DEL, you will have to run enfrun.exe and exit with the password or reboot.


Disable `safe-mode' and function keys as system boots
Disable ‘safe-mode’ and function keys as system boots

Windows 95/98/Me creates a hidden, read-only system file named MSDOS.SYS in the root of the computer’s boot drive (usually c:).  Change the properties on this file and edit it to change or add the following in the [OPTIONS] section to increase security.  These values are Boolean with a value of 1 (enabled) or 0 (disabled).

BootGUI=0 : This will disable automatic graphical startup into Windows 95/98/Me.

BootKeys=0 : This will prevent any startup keys (F5, F6, and F8) from functioning.

BootSafe=0 : This will disable Safe Mode for system startup.

Autoscan=0 : This prevents the automatic running of ScanDisk after a faulty shutdown.


BIOS settings

If you have a system with highly sensitive data and/or that is prone to be tampered with by “hackers”, then Windows Enforcer should only be part of the security measures you take.  To protect against tampering through system reboots, a BIOS password or similar boot password utility can be utilized.  To protect against a safe-mode reboot without a reboot password, take a look at Hint#2.

You can change the boot order of your system so that it will attempt to boot from the hard disk first and then resort to floppy if necessary.  This will prevent unnecessary boots from a floppy disk.


Add more layers of security to your system

In some situations, a single layer of security is not sufficient to adequately protect a system.  For additional layers of security, try our other products. All the latest releases of our products can be found on our web page at http://posum.com.


Question 13
Q13: Enforcer is running, but there isn’t an icon in the system tray and I do not have a hot key defined.  How do I get to the dialog to type in my password and stop it

A: To display the password dialog for Enforcer, simply run the executable, DsplyEnf.exe.  This program is delivered in installation directory of Enforcer.  Running this executable will send a message to Enforcer that its dialog should display.  You can then type in your password and stop Enforcer.


Question 14
Q14: How do I limit internet access to only the pages that have been approved?

A: There are two examples of limiting internet access in the Task Definition Utility helpfile.  Examples #3 and #4 describe in detail how limiting internet access can be accomplished for both Internet Explorer and Netscape.  Example task files are also available for these two examples.


Title 55

The body


Title 56

The body


Title 57

The body


Title 58

The body


Title 59

The body


Title 60

The body