Windows Enforcer Version 2.1
Windows Enforcer, Version 2.1, 1996

Windows Enforcer protects systems that are accessible to many people and require a consistent configuration and a consistent, limited selection of services.  It is also great for child-proofing a system.  This is accomplished by insuring that specified tasks either never run, always run, or are allowed to run.  It is easy to configure and requires little to no modifications to your current system configuration.  Windows 95 is required.

Registration

Installation

Task Definition (Main Dialog, enfset.exe)

Add Task/Edit Task

Special Steps for Enforcing the MS-DOS Prompt

Stop Password

Enforcement Dialog (enfrun.exe)

IMPORTANT:  To Insure Proper Security

Questions, Answers, and Examples


Installation

Copy the files enfrun.exe, enfrun.hlp, and enfset.exe to the Windows directory (c:\windows, c:\winnt, etc..).  Place the enforcement program, enfrun.exe, in your startup group so that it is executed whenever your 32-bit version of Windows (Windows 95 or NT) starts up or follow the more detailed steps in the security section for Windows 95.  When enfrun.exe starts, it will flash on the screen once to let you know it is running.  Use the setup program, enfset.exe , to define your password, which is used to terminate Windows Enforcer, and the tasks to enforce. Once these steps are complete, reboot and you are ready.

System Requirements:  Windows 95 or Windows NT.


Task Definition (Main Dialog, enfset.exe)

Task List:  This list displays the currently enforced tasks. To add a task, press the Add Task button.  To edit a task, select the desired task and press the Edit Task button.  To delete a task, select the desired task and press the Delete Task button.

Add Task:  Press this button to display the Add Task dialog and add a new task to the Task List.

Edit Task:  Press this button to display the Edit Task dialog and edit the settings of the task that is selected in the Task List.

Delete Task:  Press this button to delete the task selected in the Task List.

Stop Password:  This button will display the Stop Password dialog.  You may enter a stop password if one has not been defined or change the current stop password.  The stop password is used to terminate the execution of the Enforcement Dialog software.  This is the only manner in which Windows Enforcer can be terminated.  Other attempts such as CTRL+ALT+DEL, ESC, etc. are protected against.

OK:  This button saves the current settings and dismisses the dialog.  If the enforcement software, enfrun.exe, is currently running the changes made will take affect in approximately a minute.

Cancel:  This dismisses the dialog without saving the changes.

Dialog Menu:

File -> Close:  Dismisses the dialog (the same as Cancel)

Options -> Only Specified Tasks To Run:  Only tasks marked as Task Execution Optional or Task Must Always Run will be allowed to execute if this option is checked.  If it is not checked, any task that is not marked Task Must Never Run will be allowed to execute.

Register -> Register...:  Displays the Registration dialog.

Help -> Help...:  Displays this help file.

Help -> About Windows Enforcer...:  Displays the About dialog.


Stop Password

The Stop Password dialog defines or changes the password that halts the execution of the enforcement software.  A Stop Password must be defined.

Old Password:  This field accepts the current password, if one exists, prior to a change.

New Password:  This field accepts the new or changed password.

Confirm:  This field accepts the new password again as a confirmation that it was typed correctly.

OK:  This button saves the changes and dismisses the dialog.

Cancel:  This button dismisses the dialog and does not save the changes.


Enforcement Dialog (enfrun.exe)

The Enforcement Dialog will run as an icon in the system tray and is used to accept the Stop Password to halt execution of enfrun.exe.  The password is required for the process to terminate.  Windows Enforcer cannot be terminated in any other way.

Password:  This field accepts the Stop Password defined using the Stop Password dialog of the Task Enforcement setup software (enfset.exe).

OK:  This button accepts the password.


IMPORTANT:  To Insure Proper Security

- Place the enforcement program in your startup group so that it executes as soon as Windows starts.  The enforcement program can also be started when Windows starts by performing step #2 below.

- If you have a system with highly sensitive data and/or that is prone to be tampered with by hackers, then Windows Enforcer should only be part of the security measures you take.  To protect against tampering through system reboots, a BIOS password or similar boot password utility should be utilized.  To protect against a safe-mode reboot without a reboot password here is an alternative.

1) Windows 95 creates a hidden, read-only system file named MSDOS.SYS in the root of the computers boot drive (usually c:).  Change the properties on this file and edit it to change or add the following in the [OPTIONS] section to increase security.  These values are Boolean with a value of 1 (enabled) or 0 (disabled).

BootGUI=0 : This will disable automatic graphical startup into Windows 95.

BootKeys=0 : This will prevent any startup keys (F5, F6, and F8) from functioning.

BootFailSafe=0 : This will disable Safe Mode for system startup.

This will prevent a safe-mode reboot.   DISABLED SAFE-MODE WARNING: Make sure you have a reboot floppy available in case you need to correct any problems that may be encountered in the future.

2) Add the following to the bottom of you autoexec.bat file

win c:\windows\enfrun.exe

This will execute enfrun.exe as soon as Windows comes up without enfrun.exe being in your startup group.  This can be used independent of step #1 if you wish enfrun.exe to be executed at Windows start without placing it in your startup group.

This assumes that you placed enfrun.exe in c:\windows.  Simply change the path to where you placed enfrun.exe and you're set.  Only one of these lines can exist in your autoexec.bat.

- A task name is usually the text displayed as the title of the main window of a program.  Sometimes it is not.  In these rare cases the Browse feature can help determine the task name of the program you wish to enforce.  The Task Browser dialog will display the task names of the active tasks at the time it is displayed is run.  The task list it displays will not update automatically but can be updated by selecting the Update button.

- It is best to setup the tasks you wish to enforce and then start or restart the enforcement software (enfrun.exe) to insure that all desired tasks are properly enforced.

- For additional security try WorkStation Lock and Windows Task-Lock.  These programs provide password access to your system and specified tasks on your system. WorkStation Lock, wrklckxx.zip and Windows Task-Lock, sgllckxx.zip (where xx is the version number) can be found on the major on-line services and the WWW.


Registration

If you use an unregistered Windows Enforcer you will notice that every time you accept a password on the Enforcement Dialog, a box appears indicating you are unregistered and it displays the password you entered using the Windows Enforcer Setup Dialog .  When you send in your registration, I will return you a registration number that you will enter on the registration dialog of the Windows Enforcer Setup Dialog.  This dialog can be reached from the menu of the Windows Enforcer Setup Dialog.  This will register the software and you will no longer get the annoying box that displays your password.

Windows Enforcer is Shareware (see the Legal Stuff below).  If you feel that this software will be useful to you please send $5 (US dollars only, this can be a postal money order, a check on a US or non-US bank, or currency as long as it is in US dollars) for individual license or $30 for site license (up to 30 copies, greater than 30 copies on a case by case basis) to the following address:

Stephen A Jernigan

PO Box 21015

Huntsville, AL 35824

USA

If you are writing a check please make it out to:  Stephen A Jernigan

For CompuServe users!!  Windows Enforcer can now be registered online through SWREG.  Simply GO SWREG and follow the instructions.  The registration ID for Windows Enforcer is 11724.  Due to the CompuServe pricing structure, only single user licenses can be  registered online and each license is $10 (US).  Anyone interested in a site license registration should contact me through email at 103672.2634@compuserve.com.

The following information must be sent along with your registration fee to insure prompt registration.

Email address (or postal if no email)

Product name

Product version number

If a site license, number of copies to be used

Please provide the name of the software you are registering, the version of the software, and your email address (or if you don't have one, your postal address) so you can be correctly registered.  An email address will provide both of us with quicker and easier registration.

Please report any bugs, suggestions for improvement or new features you would like to see.  I can be reached through email at 103672.2634@compuserve.com

- Version 1.0

- Initial Release

- Version 1.1

- Corrected a bug that allowed shutdown during error dialog.

- Version 2.0

- Added the Execution Optional task setting and removed the

  50 task limit on the number of tasks that could be defined.

- Version 2.1

- Enforcer (enfrun.exe) now runs from the system tray instead

  of the Taskbar and a conflict with Windows Task Lock was

  corrected.

LEGAL STUFF:

DEFINITION OF SHAREWARE

Shareware distribution gives users a chance to try software before buying it. If you try a Shareware program and continue using it, you are expected to register. Individual programs differ on details -- some request registration while others require it, some specify a maximum trial period. With registration, you get anything from the simple right to continue using the software to an updated program with printed manual.

Copyright laws apply to both Shareware and commercial software, and the copyright holder retains all rights, with a few specific exceptions as stated below. Shareware authors are accomplished programmers, just like commercial authors, and the programs are of comparable quality. (In both cases, there are good programs and bad ones!) The main difference is in the method of distribution. The author specifically grants the right to copy and distribute the software, either to all and sundry or to a specific group. For example, some authors require written permission before a commercial disk vendor may copy their Shareware.

Shareware is a distribution method, not a type of software. You should find software that suits your needs and pocketbook, whether it's commercial or Shareware. The Shareware system makes fitting your needs easier, because you can try before you buy. And because the overhead is low, prices are low also. Shareware has the ultimate money-back guarantee -- if you don't use the product, you don't pay for it.

DISCLAIMER - AGREEMENT

Users of Windows Enforcer must accept this disclaimer of warranty: "Windows Enforcer is supplied as is.  The author disclaims all warranties, expressed or implied, including, without limitation, the warranties of merchantability and of fitness for any purpose. The author assumes no liability for damages, direct or consequential, which may result from the use of Windows Enforcer."

Windows Enforcer is a "shareware program" and is provided at no charge to the user for evaluation.  Feel free to share it with your friends, but please do not give it away altered or as part of another system.  The essence of "user-supported" software is to provide personal computer users with quality software without high prices, and yet to provide incentive for programmers to continue to develop new products.  If you find this program useful, you must make a registration payment of $5 to Stephen A Jernigan.  The $5 registration fee will license one copy for use on any one computer at any one time.  You must treat this software just  like a book.  An example is that this software may be used by any number of people and may be freely moved from one computer location to another, so long as there is no possibility of it being used at one location while it's being used at another. Just as a book cannot be read by two different persons at the same time.

Commercial users of Windows Enforcer must register and pay for their copies of Windows Enforcer as a site-license.  A site-license is granted for a single site such as a school, library, or small business that will utilize up to 30 copies of Windows Enforcer for a fee of $30.  Registration for sites requiring greater than 30 copies will be handled on a case by case basis.

Anyone distributing Windows Enforcer for any kind of remuneration must first contact Stephen A Jernigan at the address given for authorization.

You are encouraged to pass a copy of Windows Enforcer along to your friends for evaluation.  Please encourage them to register their copy if they find that they can use it.  All registered users will receive a registration number to fully enable the latest version of the Windows Enforcer software.

This software may be freely distributed as long as the following files are all kept together and unmodified and no remuneration is received by the person or persons distributing said software.

enfset.exe

enfrun.hlp

enfrun.exe

readme.txt

Copyright (c) 1996  Stephen A Jernigan


Add Task/Edit Task

The Add Task and the Edit Task dialog function in the same manner.  The Add Task starts with the defaults and the Edit Task with the settings of the task selected from the Task List on the main dialog.  If you want to enforce the MS-DOS Prompt to Never Run then special steps need to be taken to properly set the Properties.

Task Must Never Run:  This indicates that the specified Task Name must never be allowed to run.  For this option the Program Name is not required.

Task Must Always Run:  This indicates that the specified Task Name must always run.  The Program Name is required for this option.

Task Execution Optional:  This indicates that the specified Task Name may or may not execute as the user desires.  This option is useful if you want to allow only a few known tasks to be executed as needed and you need to lock out any other applications.  This is particularily useful when you dont know what those other apps might be.  For this option to be enforced, the Only Allowed Tasks To Run option must be checked under the Options on the main menu.  For this option the Program Name is not required.

Some examples on using these settings are provided.

Task Name:  Enter the name of the task you wish to enforce in this field.  The task name is usually the same as the text displayed as the window title.  You do not have to enter the whole title.  The comparison will be done only on the portion you enter.  For example, if you enter Notepad as the title the enforcement software will enforce Notepad - (Untitled), Notepad - mytext.txt, etc.  To select from a list of the currently running tasks use the Browse button.

Browse:  This button displays the Task Browser dialog.

Simply select the task you wish to enforce from the list box.  The task name will appear in the Selected Task field.  You may return this name as selected to the Task Definition dialog or edit it.  If some new tasks have started you may select Update to refresh the list box.  As always OK dismisses the dialog accepting the selected task and Cancel simply dismisses the dialog.

Program Name:  Enter the full path and filename of the executable you wish to always run.  This is not required if you have specified the task to Never Run.  If you do not know the exact path or name of the executable, then use the Browse button.  Under the Program Name, is a select list with two options: Run Normally or Maintain Maximum Window.  This selection indicates if the program should simply be executed in a normal manner or if it should always be kept as a maximized window.

Browse:  This button displays the Program Browser dialog.

The Program Browser is a standard file finder dialog.  Simply browse the drives and directories of your choice to find the desired file.  Select OK when you are done and the program name with a full path will appear in the Program Name field.

OK:  This button saves the changes and dismisses the dialog.

Cancel:  This button dismisses the dialog and does not save the changes.


Special Steps for Enforcing the MS-DOS Prompt

To properly enforce the MS-DOS Prompt, the Properties must be set a certain way.  Bring up the Properties dialog and select the Screen tab.  When the tab appears, select the Window radio button in the Usage section.  This insures that the MS-DOS Prompt will appear as a Window.  This is required for the Windows Enforcer to work properly.

Next, select the Misc tab.  Make sure the check box in the Termination section is NOT checked.  This insures a clean closure of the MS-DOS Prompt window.

After this is done, add the MS-DOS Prompt Properties dialog as a task to Never Run.  This is done on the Add Task dialog.


Questions, Answers, and Examples

The following hypothetical questions cover a few generic applications of Windows Enforcer.  Combinations and/or variations on the procedures presented here should allow you to set up a system with the configuration control you desire.

Q:  How do I prevent a user from executing a task using the RUN command or mess up my task bar?

A: The Taskbar Properties, Display Properties, and the Run commands are accessable from the task bar and as such are child windows of the task bar.  These must be added to the task list by manually typing in the titles of their dialogs (i.e. their task names) in the Task Name field of the Add Task dialog.  Make sure the Task Must Never Run selection is on for each of these.  When you return to the main dialog your task list should now contain Taskbar Properties, Display Properties, and Run.  Select OK and you are ready to run enfrun.exe to never allow these commands to execute.

Q: How do I set up a system to never allow the DOS prompt to run but still let anything else run?

A:  If enfrun.exe is running, stop it using your Stop Password.  Set your DOS prompts properties as described in the Special Steps for Enforcing the MS-DOS Prompt .  When this has been done, bring up your DOS Prompt and keep it running.  Now run enfset.exe.  If any tasks are defined then delete them.  Look at the Options -> Only Specified Tasks To Run menu item and make sure it is NOT checked.  You are now ready to add the DOS Prompt as a task.  Select the Add Task button to bring up the Add Task dialog.  Select the Browse button at the end of the Task Name field to bring up the Task Browser dialog.  Select the DOS Prompt task from the list box and select OK.  Make sure the Task Must Never Run selection is on and then select OK.  On the main dialog, your task list should contain only a DOS Prompt entry.  Select OK and you are ready to run enfrun.exe to never allow the DOS Prompt to run but still let anything else run.

Q: How do I set up a system to always run my Demo App and nothing else?

A:  If enfrun.exe is running, stop it using your Stop Password.  Start your Demo App and then run enfset.exe.  If any tasks are defined then delete them.  Look at the Options -> Only Specified Tasks To Run menu item and make sure it IS checked.  You are now ready to add your Demo App as a task.  Select the Add Task button to bring up the Add Task dialog.  Select the Browse button at the end of the Task Name field to bring up the Task Browser dialog.  Select your Demo App task from the list box and select OK.  Make sure the Task Must Always Run selection is on and then select OK.  On the main dialog, your task list should contain only a Demo App entry.  Some tasks must be specifically added to your task list for them to not execute.  The Run, Display Properties, and Taskbar Properties commands are examples of this. To make sure a user does not reconfigure your system, add these tasks as detailed in the first question of this section.  When you return to the main dialog your task list should now contain your Demo App, Run, Display Properties, and Taskbar Properties.  Select OK and you are ready to run enfrun.exe to always run your Demo App and nothing else.

Q: How do I set up a public system to always run a specific app, allow any of three others to execute if necessary and always lock out anything else even if I dont know what these other apps might be?

A:  Set up your task list using enfset.exe as described in the previous question.  This will set up Windows Enforcer to always run your specified application and prevent all others from executing.  Now, Add the three optional tasks using the Add Task dialog.  Make sure the Task Execution Optional selection is on for each of the three optional applications.  When you return to the main dialog your task list should now contain your specified application, Run, Taskbar Properties, Display Properties, and your three optional tasks.  Select OK and you are ready to run enfrun.exe to always run your specific app, optionally run your other three and nothing else.

Q:  How do I use Enforcer to child-proof my system?

A:  If enfrun.exe is running stop it with your Stop Password.  Run enfset.exe.  If any tasks are defined then delete them.  Look at the Options -> Only Specified Tasks To Run menu item and make sure it IS checked.  You are now ready to add the applications you wish your children to be allowed to run as tasks.  Add each task as described above.  When you are finished, your task list on the main dialog should contain only those applications that you wish you children to have access to.  Now, to make sure your children do not access a program through the Run command or reconfigure your taskbar, add the Run, Display Properties, and Taskbar Properties tasks as detailed in the first question of this section.  When this is complete, set up Windows to execute enfrun.exe as detailed in the IMPORTANT:  To Insure Proper Security section This will start Enforcer as Windows comes up and only allow access to the tasks you defined.  When you wish to disable the child-proofing, simply bring up the enfrun.exe dialog and type in your Stop Password.  Now you have complete access to your system.  If you wish to be able to child-proof on demand, them setup a shortcut to enfrun.exe.  This will allow optional child-proofing with a single selection.