We have set the user account to normal user to restrict the installation of
program by administrator. However, Skype and Yahoo Messager can still be
installed. Is there any way to prohibit the sending and receiving files in
these two program to avoid virus inflected?

Thanks,

Scott

Scott,

Sounds like you have Power Users or Administrators of their machines

Installation isn't a problem but remember they both use port 80 to
send/receive files. If you have a layer 3 managed switch then you can check
for packets... or use ISA 2006 to filter those sites for you. ISA would be
the cheapest option

Remember, in Skype you have the advanced connection tab with a port to punch
through with uPnP

Yahoo had a big problem with Symantec Client Security 3.1.6 not allowing
attachments to be sent without the built-in firewall being disabled

Here's a simple Google search with a table of ports used:

http://www.chebucto.ns.ca/~rakerman/port-table.html

Found the following info too:

Service: remote: port 5050, 5150, and 8000 local: 5101 and 1638
Audio: remote: 5001 local: 1644 and 5000
File transfer: remote: 1614 local: 80/81/82
Webcam: remote: 80 local: 1677

Y!Tunnel
Service: remote: 1455, 5050, 1071, and 1074 local: 8000, 8001, and 1073

Skype:

80/443 & the uPnP port I mentioned above

--
SPAMCOP User


"Scott" <NoSpam-Scott.Xe******.com> wrote in message
news:OJkMOeJGKHA.4004@TK2MSFTNGP05.phx.gbl...
> We have set the user account to normal user to restrict the installation
> of program by administrator. However, Skype and Yahoo Messager can still
> be installed. Is there any way to prohibit the sending and receiving
> files in these two program to avoid virus inflected?
>
> Thanks,
>
> Scott

On Aug 8, 10:17*pm, "Scott" <NoSpam-Scott...******.com> wrote:
> We have set the user account to normal user to restrict the installation of
> program by administrator. *However, Skype and Yahoo Messager can still be
> installed. *Is there any way to prohibit the sending and receiving files in
> these two program to avoid virus inflected?
>
> Thanks,
>
> Scott

The answer to your question is yes. You can still have Skype and
Yahoo! Messenger but disable file transfer.

Let's fix Skype first.

You can disable just File Transfer with this registry addition/
modigication:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Skype\Phone
DisableFileTransfer=dword:00000001

You can disable the Skype API entirely with this registry addition/
modification:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Skype\Phone
DisableApi=dword:00000001

Try it on your own machine to see how it works.

If your users figure this out and have access to the registry with
regedit or other methods, they can undo this.

Now you can start working on some enforcement and restriction policies
in that area. You can batten down the hatches as tight as you want.

I don't know your environment but configuration of such things is
generally a matter of establishing enforceable policies.

Jose,

Thanks for your reply. Below was my test result.

"Jose" <jose_ease******.com> 在郵件
news:da8197dd-c901-4c0e-9710-8d74baffb175@p15g2000vbl.googlegroups.com ä¸*撰寫...
On Aug 8, 10:17 pm, "Scott" <NoSpam-Scott...******.com> wrote:
> We have set the user account to normal user to restrict the installation
> of
> program by administrator. However, Skype and Yahoo Messager can still be
> installed. Is there any way to prohibit the sending and receiving files in
> these two program to avoid virus inflected?
>
> Thanks,
>
> Scott

The answer to your question is yes. You can still have Skype and
Yahoo! Messenger but disable file transfer.

Let's fix Skype first.

You can disable just File Transfer with this registry addition/
modigication:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Skype\Phone
DisableFileTransfer=dword:00000001

> I could not find this one but found similar one:
> HKEY_LOCAL_MACHINE\SOFTWARE\Skype\Phone

You can disable the Skype API entirely with this registry addition/
modification:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Skype\Phone
DisableApi=dword:00000001

> Same as above & found a similar one:
> HKEY_LOCAL_MACHINE\SOFTWARE\Skype\Phone

Try it on your own machine to see how it works.

> It did not work. I still can send a file and the recipient can receive
> the file if he/she wants to receive it.

If your users figure this out and have access to the registry with
regedit or other methods, they can undo this.

Now you can start working on some enforcement and restriction policies
in that area. You can batten down the hatches as tight as you want.

I don't know your environment but configuration of such things is
generally a matter of establishing enforceable policies.

> The computer is set to workgroup and the user account type is Limited.
> What else should I set?