How to disable Task Manager

[Bladeforce]

Hi can anybody help me?
I want to disable a standard user from accessing the task manager (I already know this can be done via the registry and gpedit.msc) but also I dont want to disable the administrators access to the task manager at the same time.

If I disable the task manager via the registry or gpedit.msc it seems to block access by the admin account to.

Any help would be very much appreciated!

 

[H2SO4]

Local policy affects all accounts.

Out of curiosity, why do you want to do this? Limited (non-admin) accounts are already - by definition - prevented from doing things which require admin rights. Also, you somehow hobble the Task Manager, that doesn't by itself prevent them from doing the same thing they would have done in TM in other ways.

 

[SquonkSC]

Hi can anybody help me?
I want to disable a standard user from accessing the task manager (I already know this can be done via the registry and gpedit.msc) but also I dont want to disable the administrators access to the task manager at the same time.

If I disable the task manager via the registry or gpedit.msc it seems to block access by the admin account to.

Any help would be very much appreciated!

Hi Bladeforce,

Taskmgr.exe is by default set to read/read & execute for users.

There are two ways to disable it for users.

1. Edit the permissions for the users, uncheck the read and read & execute permissions.

2. Or remove the users from the security list.

I recommend the first.

It's not as straight forward as it seems, because for this file, users inherit permissions, and therefore can not be altered without a few steps.

a. Go to C:\Windows\System32\taskmgr.exe,
b. right click on the file,
c. chose properties,
d. go to the security tab
e. click on advanced,
f. click on edit permissions
g. in the warning click ok
h. click on users
i. uncheck the inherit permissions..... button
j. in the next dialog click on add (not delete)
k. click a few time ok until you are back in the security tab
l. Now you can click the edit button and edit the permissions of the users.
m. Uncheck the two permission boxes.

That's it.

 

[Bladeforce]

Thanks for the replies. Firstly I'd like to do it because I just want the user to not have access to the task manager. i have set up the standard account and it gives full access to this users task manager with the ability to shut down programs. A little silly security wise.

@squonksc thanks mate one problem though when i uncheck the 2 permission boxes and apply I get this "unable to save permission changes, Access is denied" error :/

 

[Barman58]

try taking ownership of the ,exe first. looks lika a UAC dual token issue

edit have just checked and the owner is trustedInstaller so it may need the full administrator account to allocate owner

 

[logicearth]

I would recommend not to remove access to task manager. How would the user force shutdown a rouge application? Giving the user the means to shutdown applications of there own is not a security threat. As a standard user they would only be given permission to terminate processes governed by there user account ONLY.

 

[H2SO4]

Thanks for the replies. Firstly I'd like to do it because I just want the user to not have access to the task manager. i have set up the standard account and it gives full access to this users task manager with the ability to shut down programs. A little silly security wise.

@squonksc thanks mate one problem though when i uncheck the 2 permission boxes and apply I get this "unable to save permission changes, Access is denied" error :/

Preventing access to the TM does nothing to prevent users from using other utilities to kill those processes to which they've got access. It only hampers the uninformed. That may or may not be enough for your purposes, but it wouldn't be considered an adequate solution in a secure environment.

 

[H2SO4]

I would recommend not to remove access to task manager. How would the user force shutdown a rouge application? Giving the user the means to shutdown applications of there own is not a security threat. As a standard user they would only be given permission to terminate processes governed by there user account ONLY.

What he said.

 

[SquonkSC]

Thanks for the replies. Firstly I'd like to do it because I just want the user to not have access to the task manager. i have set up the standard account and it gives full access to this users task manager with the ability to shut down programs. A little silly security wise.

@squonksc thanks mate one problem though when i uncheck the 2 permission boxes and apply I get this "unable to save permission changes, Access is denied" error :/

I hope you are trying to edit it from within an admin account.

You can't lay down restrictions for users from the user account it self.

If you did try it from within your own account, you might want to add your own username to the taksmgr.exe security list. (with full perms)

By default "system", "administrators" and "users" are there.

If it still doesn't work get back to me, we will go through it step by step.

greetz.

 

[SquonkSC]

Oh, by the way,

I concur with the comments made by my collegues.

I wouldn't want to disable taskmanager for users for reasons already mentioned.

Taskmanager doesn't give a user the power to change anything, it just gives them the ability to shoot down hung apps.

Greetz

 

[Brink]

Hi can anybody help me?
I want to disable a standard user from accessing the task manager (I already know this can be done via the registry and gpedit.msc) but also I dont want to disable the administrators access to the task manager at the same time.

If I disable the task manager via the registry or gpedit.msc it seems to block access by the admin account to.

Any help would be very much appreciated!

Hello Bladeforce,

This will help show you how to disable Task Manager for all users on the computer. It's the same as in Vista.

Task Manager - Enable or Disable - Vista Forums

Hope this helps,
Shawn

 

[SquonkSC]

Hi can anybody help me?
I want to disable a standard user from accessing the task manager (I already know this can be done via the registry and gpedit.msc) but also I dont want to disable the administrators access to the task manager at the same time.

If I disable the task manager via the registry or gpedit.msc it seems to block access by the admin account to.

Any help would be very much appreciated!

Hello Bladeforce,

This will help show you how to disable Task Manager for all users on the computer. It's the same as in Vista.

Task Manager - Enable or Disable - Vista Forums

Hope this helps,
Shawn

Hi Shawn,

This method also disables it for his own admin account.

He wants to disable it for restricted users only.

Greetz

 

[Brink]

DOH, missed that part.

Thank you Michel.

 

[Home]

This tutorial should help

http://www.sevenforums.com/tutorial...w-deny-access-permission.html?filter=Security