Copyright: PMA Copyright ® 1994-5 P.M. Chefalo


Contents
 PM Access Control Help Contents

Thanks for downloading PM Access Control, Shareware Version 1.50S! PM Access Control is SHAREWARE!  A fifteen day evaluation period is recommended.  After that, if you like and use PM Access Control, you must REGISTER!

Many magazine help columns and power tip articles tell you that the Windows Program Manager can be protected from configuration changes by unauthorized users through entries in your PROGMAN.INI file. The main problem is that Microsoft didn't allow administrators to easily modify the settings in Progman, nor did they protect the changes with any sort of password security. (They didn't even document it in the regular Windows manual!)  PM Access Control is an answer to this problem.

PM Access Control is an application that allows you to easily understand and control the ways in which a user can restrict use of the Microsoft Windows 3.1 Program Manager, and thus Windows itself.  This control can extend just to installations on a local Windows drive, or to a remote drive on a network.  You can prevent a user from using PM Access Control to undo your changes without a password.  If you share a Windows workstation with other people, or if administer a group of Windows workstations for unsophisticated users, this utility is for you!

With PM Access Control, you can disallow exiting Windows for DOS, control the running of applications other than those already set up in Program Groups, and limit the modifications to the look and arrangement of the Program Manager. PM Access Control allows you to preview the extent of your Program Manager changes in a unique Windows interface.  You can also easily restore the Windows defaults.

See the topics below for detailed PM Access Control information:

Installation

Using PM Access Control

Registration

Click here on Revision History for a summary of PM Access Control improvements.


Revision History
PM Access Control Revision History

Version 1.00S	First Shareware Version.

Version 1.00aS	Fixed Windows Restart bug.

Version 1.50	Added  "group" for Windows configuration utilities launching.  Added  a "standard" Windows user menu to the program, in addition to the Program Manager demonstration interface.   Corrected check box mix-up for menu restriction choices. Checked for network drive on loading before asking.  Check for Windows 3.1 allows continuation for non-Intel CPUs.  Centered  forms on launching.  Modified Help File extensively. Added hidden security topic to help, available only to password.


PM Group Editing Options
 Program Manager Group Editing Options

This section of PM Access Control determines the extent to which an end  user can modify Program Manager groups. Not surprisingly, only groups with read-write access can be modified by Program Manager; shared or read-only groups cannot be modified.  This section may be set to one of the following option values:

Choice	Access Level
Allow All Edits	Allows any modifications to any program group. This is the Program Manager default.
No Group Edits	Prevents your users from creating, renaming, or deleting program groups.
No Group or Item Edits	Prevents your users from creating, renaming, or deleting program groups and from creating or deleting program items in a program group.
No Group, Item, Command Edits	Prevents your users from creating, renaming, or deleting program groups; from creating or deleting program items in a program group; and from changing the command lines for program items in a program group.
Allow No Edits	Prevents the user from changing any property of an item in any program group; from creating, deleting, or renaming program groups; from creating or deleting program items in a program group; and from changing command lines for program items in a program group.

When you make a setting in this section, you may preview the effect it will have in the Program Manager by clicking on the "Properties.." choice in the PM Access Control "File" menu, if it is showing, based on the setting of the "NoFileMenu Option" in the "PM Menu On/Off Toggle" section.

Setting "NoRun Option" to "True" by checking the box, and "Group Editing Option" to "No Group, Item, Command Edits" prevents your users from using the Program Manager to run any applications that are not already set-up in a program group.


PM Menu On/Off Toggles
Program Manager Menu On/Off Toggles

This section of PM Access Control determines the extent to which an end  user can modify the Program Manager menus. This section may be set to the following option values:

Check Box	Access Level
NoRun Option	Disables the Run command on the File menu. If this entry is checked, the Run command is disabled. The default is not checked.
NoClose Option	Prevents a user from exiting the Program Manager through the File menu, the System menu, the ALT+F4  accelerator, or the Task List. If this entry is checked, the user cannot exit the Program Manager, and if Program Manager is the shell, Windows itself.  The default is not checked.
NoSaveSettings Option	Disables the "Save Settings on Exit" command on the "Options" menu, if this entry is checked. The default is not checked.
NoFileMenu Option	Disables the File menu and all of its commands. If this entry is checked, the File menu is disabled. The default setting not checked.
When you make a setting in this section, you may preview the effect it will have in the Program Manager by observing the "File" and "Options" menus of PM Access Control.

Setting "NoRun Option" to "True" by checking the box, and "Group Editing Option" to "No Group, Item, Command Edits" prevents your users from using the Program Manager to run any applications that are not already set-up in a program group.


Installation

This file is PMA.HLP.  You extracted this file from the archive PMACCS.ZIP, which also contained the following files:

Name	Size	Date	Time
PMACCESS.EXE	43801	2-25-95	3:30p
VBASM.DLL	6656	9-27-94	1:20a
We recommend that you copy PMACCESS.EXE, the PM Access Control executable and this file, PMA.HLP, to your Microsoft Windows default directory, normally named \WINDOWS; copy VBASM.DLL to your \WINDOWS\SYSTEM directory.  We recommend the use of a Windows File Manager for these tasks, and would NOT overwrite files of the same name but with later dates.

One additional support file is required to use PM Access Control Version 1.50S: VBRUN300.DLL, the runtime module for Visual Basic 3.0.  If you run any other Visual Basic 3.0 programs, you have this file, probably in your \WINDOWS or \WINDOWS\SYSTEM directory.  Otherwise, VBRUN300.DLL is available from the same BBS, on-line system or software distributor where you obtained PMACCS.ZIP.


Registration Info
Shareware Registration Information

PM Access Control is SHAREWARE!  A fifteen day evaluation period is recommended.  After that, if you use PM Access Control,  you must REGISTER, to be in compliance with Copyright Law!  Registration for a private individual at home is $5 per computer; for users in a business or government, the fee is $15 per computer PM Access Control is installed on.  Send your Registration Fees to:

VB Expressions

64 Burning Brush Drive

Rochester, NY 14606-4642

Kindly include the Version number and the source where you got PM Access Control, and, if you have one, your E-mail address.  Registrants of Version 1.00S and 1.00aS need not re-register; your support is greatly appreciated.

(Because PM Access Control is not crippled in any way, and to keep costs low, you will not receive a "Registered" copy of the program in return for registration, but will have a valid license to use the copy you are using!)

You can also look for other VB Expressions utilities.  There are two other Microsoft Program Manager customization utilities (like PM Access Control.) PM Fonts Chooser allows you to change your Program Manager fonts from the Microsoft default to any installed screen font and PM Group Sorter allows you to set the order of your Program Manager Groups.

There are also three Desktop Assistants: Draggin' Viewer, a drag-and-drop file viewing/application launching utility, Printer's Daemon, a drag-and-drop text file printing utility, and Trash Free-K!, a drag-and-drop file deletion utility. Smartclp is a Windows Clipboard enhancer. Finally, the DOS/Unix Text Translator lets you translate files between these two popular computing environments. Good stuff (if we may say so ourselves!)

We'd be interested in your comments or suggestions on PM Access Control. You can reach us by E-mail on CompuServe, ID 73457,3603 or AmericaOnline, ScreenName PMChefalo.

PM Access Control - Copyright 1994-5 by P.M. Chefalo


Security

This Help Topic is only available the first time you open PM Access Control or when you open Help with your password from the application.  Be sure to read this Topic, since it explains what to do if you forget your password!

To see the normal PM Access Control Help, click on the topic below:

PM Access Control Help Contents

PM Access Control offers limited security for your Program Manager settings.  The program writes a unreadable, slightly encrypted password in the [Restrictions] section of the PROGMAN.INI file, the same section where the Program Manager settings are stored.  The password is not "case sensitive"; that is, "PASSWORD" is the same as "password", and "Password".  Non-alphanumeric characters are entered as literal characters without encryption, so make limited use of them.

If you forget your password, what do you do?  As a sophisticated Windows user, open the file PROGMAN.INI in a text editor, find the [Restrictions] section, and erase the line that begins "PMAccess=".  PM Access Control will prompt you to set a new password when you next start the program.

The security is limited because a sophisticated Windows user, who knows how the settings are stored, and how to use a text editor to change INI file settings, can easily erase the section, or change any setting.  However, most users are not quite aware of how Windows works, and many have little experience with plain text editors, so you can effectively use PM Access Control as a tool to manipulate the Program Manager.  If you want to control Windows by way of the Program Manager to the utmost, set the "NoRun Option" in the "PM Menu On/Off Toggles" to True (by checking the box) and "PM Group Editing Options" to "No Group, Item, Command Edits" to prevent a user from using Program Manager to run any applications that are not already in a program group, including PM Access Control.

If you have especially nosy users, you can rename the PM Access Control executable file, PMACCESS.EXE, to something else, and launch it from another application's icon.  Please don't rename this Help file; if you do PM Access Control won't be able to find the file!  We named this file PMA.HLP to slightly hide its use.  Even if you don't rename the program, changing Program Manager settings requires the entry of the correct password.  And if there is no password set for PM Access Control, it will prompt you to enter one.


Launching PM Access Control

To launch PM Access Control, we suggest that add its icon to a Program Manager Program Group.  For security reasons, you may wish to hide the presence of the program by re-naming it, and by using the icon of a different program.  You can do this by selecting "Properties..." from the Program Manager "File" menu, then by selecting "Change Icon".  You can select any Windows program and use one of its icons for PM Access Control.

If you are connected to a network, the first window you will see after launching PM Access Control is a box asking you to chose a "Local Drive" or "Network Drive...".  If you choose "Local Drive", PM Access Control will modify the PROGMAN.INI file in your computer's Windows directory.  If you choose "Network" you will see another Window asking you to choose the network drive and directory of the PROGMAN.INI file you want to modify. PM Access Control will look for the file in that directory.  If it cannot find it, or if the file is Read-Only, then PM Access Control will notify you, and ask if you want to quit or to default to your local computer's Windows directory.  Of course, you can also select your local (normally C: drive and \WINDOWS directory) PROGMAN.INI to modify if you mistakenly select "Network Drive..." (a "feature" of the Visual Basic drive selection control).

NOTE that modifications to networked PROGMAN.INI files will only be in effect after the remote users restart Windows.


Using PM Access Control
Using PM Access Control and Its Features

Using PM Access Control is easy!  But some of its features need some explanation.

An important thing to learn is that the application menu has two modes: the Program Manager Demo mode is a mock-up, and not functional and all control functions are performed by the eight buttons on the bottom part of the faceplate; and Standard Windows Menu mode, where both the menu and the control buttons are functional.

When PM Access Control is launched, the standard menus are enabled.  To try the demo mode, click on the PM Demo/Standard Menu Toggle Button (see below).

Click to see an individual topic, or use the "Browse Buttons" to see the topics in sequence.

Launching PM Access Control

The PM Access Control User Interface

PM Menu On/Off Toggles

PM Group Editing Options

PM Access Control Command Buttons

Save Changes Button

Set To Defaults Button

Change Password Button

Show Utilities Button

PM Demo/Standard Menu Toggle Button

PM Access Help Button

Quit PM Access Button

About PM Access Button

Context-sensitive help for these controls is available by selecting them with the tab key or a mouse click, then pressing the F1 key.


Closing PM Access Control
Shutting Down PM Access Control

Close PM Access Control by clicking on the "Quit PM Access" button on the PM Access Control faceplate, or by selecting "Exit" from the "File" menu when PM Access Control is in its standard Windows interface mode.

Another way to quit the program is from the Windows Task Manager.  The Task Manager is made available by double-clicking a blank spot on the Windows desktop, or by entering the keystrokes "Ctrl" and "Esc" simultaneously.  Then select "PM Access Control" from the list box and click the "End Task" button.


The PM Access Control Interface
The PM Access Control User Interface

The PM Access Control user interface is somewhat unique among Windows programs.  It consists of four parts: a menu bar, two access control groups, and the PM Access Control command buttons, and two modes: Standard Windows Menu, and Program Manager Menu Model.  Click on the faceplate below for more detail of the Program Manager Menu Model mode.

In the Program Manager Menu Model mode, neither the menu bar nor properties dialog are functional; all control of PM Access Control is performed through it's command buttons, on the bottom of the control faceplate.  Think of it as sort of a remote control for the Program Manager!  In Standard Windows Menu mode, the normal program control through drop-down menus is available.


The menu bar shown here is a model of the Program Manager (PM) menu.  In this mode, as you toggle menu access control options for the PM, the menu structure of PM Access Control changes to reflect what the Program Manager menu will look like with that setting.  The "File Properties" menu item will open a mock-up of the Program Manager properties dialog, showing how it will look as you change PM group editing option levels. The dialog will open for about five seconds, then close by itself.  While it is displayed, you can experiment with its settings.


The File Menu On/Off Toggles group contains the menu control options.  A check in the box means that the option is chosen; by default, no options are chosen.

See Also:

PM Menu On/Off Toggles


The Group editing Options group contains the PM group dialog box control options.  Only one of the options can be  chosen; by default, the first option,  "Allow All Edits", is chosen.

See Also:

PM Group Editing Options


These eight buttons help you control PM Access Control.  When the menu bar is a model of the Program Manager menu, you must use these buttons to perform the functions indicated, including exiting the application.  Otherwise, you can use these buttons or the menu functions.

See Details:

Save Changes Button

Set To Defaults Button

Change Password Button

Show Utilities Button

PM Demo/Standard Menu Toggle Button

PM Access Help Button

Quit PM Access Button

About PM Access Button


To toggle something is to change its state (for instance, off and on) with the same action, like clicking a Windows check box with a click.


Set to Defaults Button

You can set all the user restrictions for the Program Manager to their Microsoft defaults (unrestricted) by clicking the "Set to Defaults" button.  You will be prompted for the current PM Access Control password.  If you enter the password correctly, you will be asked if you wish to restart Windows, unless you are restricting a remote drive's PROGMAN.INI.  The reverted settings will not be active until Program Manager is re-started.

You may use this command button to cause the Program Manager to return to its default regardless of whether they were originally set by PM Access Control or not.


Save Changes Button

You can save your changes to the user restrictions for the Program Manager to their Microsoft defaults by clicking the "Save Changes" button.  You will be prompted for the current PM Access Control password.  If you enter the password correctly, you will be asked if you wish to restart Windows, unless you are restricting a remote drive PROGMAN.INI.  The changed settings will not be active until Program Manager is re-started.


Change Password Button

Change your current PM Access Control password by clicking the "Change Password" button.  You will be prompted for the current PM Access Control password.  If you enter the password correctly, you will be asked to enter, then confirm, a new password.  Note that the password is NOT case-sensitive. The change will be effective immediately.


PM Access Help
PM Access Help Button

See this PM Access Control Help file by clicking the "PM Access Help" button.  The Help file must be in the same directory as the executable, or in the Windows directory.

Help can also be obtained through context sensitivity.  Highlight a control with the Tab key and press F1 for a Help screen for that control action.


About PM Access Button

See the PM Access Control "About..." box by clicking the "About PM Access" button.  You will also see a display of your available Windows System Resources and memory.


Show Utilities Button

Clicking on this button brings up a window resembling a Program Manager group window from which you can launch the six most powerful standard Windows configuration utilities: the File Manager, the Control Panel, the System Editor, the Notepad, the MS-DOS prompt and Windows Setup.  Unlike a Program Manager group, however, you cannot add any programs to this window.

Navigating through this window is the similar to a standard Program Manager group: use the arrow keys or click on the icons.  Contrary to a Program Manager group, the Tab and Shift-Tab keys and the up- and down-arrow keys also switch between icons.  The window can be closed by double-clicking the System menu.  You can minimize the window with the minimize arrow.

To launch the programs, double-click on the icons, or hit the enter key and the program represented by the highlighted icon will start.  Please consult your Windows manuals for instructions on the use of these programs.

To maximize security of a Windows configuration, these utilities should be hidden from casual users by removing them from all Program Manager groups - irreparable damage can be inflicted with these utilities.  Special care must be taken with Notepad - many programs install README files as a file to be loaded in Notepad.  If the user opens the README, then they can open any other file with the Notepad utility.

By Microsoft's default, the File Manager, the Control Panel, the MS-DOS prompt and the Windows Setup programs are all in the Program Manager "Main" group, and Notepad is in the "Accessories" group.  The System Editor is normally not shown in any group.

NOTE that we are not recommending that the utilities be erased from the machine - if they are, you will be hampered in your configuration efforts - but to simply hide them.  Hiding them from other users can be as easy as deleting the icons from their Program Manager groups, or as complex as substituting their icons, and moving the programs to other directories on the disk, but still in the computer's execution path.

The PM Access Control Utilities "group" window can be minimized, by clicking the "down arrow" in the upper right-hand corner, or closed by double-clicking the system menu in the upper left-hand corner of the window.


PM Demo/Standard Interface Toggle Button
PM Demo/Standard Menu Toggle Button

PM Access Control features two menu styles: one that demonstrates the effects of the utility on the Program Manager; the other is of the standard Windows style.  The default is the standard Windows menu. This toggle button controls which will show at a given time.

When the standard menu is showing, PM Access Control can be controlled from the menu bar, or from the command buttons on the bottom of the window.  When the PM Demo menus are showing, PM Access Control must be operated from the command buttons only, or you can toggle back to the standard menu.


PM Access Control can modify a PROGMAN.INI file on any drive on which you have write-access.  As a practical matter, you must have a peer-to-peer connection to the other Windows machine, since the PROGMAN.INI file is normally on the boot drive for the machine.  However, if your users share a PROGMAN.INI file on a network drive, or if you download such files from a network drive, then this feature of PM Access Control is for you!


The Microsoft File Manager (WINFILE.EXE) is arguably the most powerful utility provided with Windows 3.1.  From the File Manager, a user can delete (almost) any and all files on a computer or a network, at the touch of the delete key; launch all applications and utilities; and generally wreak havoc!  If a user can launch File Manager, there's no control over the computer's setup.  To impose security on a Windows computer, hide the File Manager from the users!  Also note that many utility packages offer their version of the File Manager, so you might have to hide those too.

On the other hand, if you expect your co-workers to hunt for files, or attach network drives, or format floppy disks, you had better supply equivalent capabilities to these File Manager duties.  (There are nice shareware utilities that you might consider.)


The Windows Control Panel, CONTROL.EXE, allows the user to access many features of Windows 3.1, offering small utilities (affectionately called "applets") that modify settings in the WIN.INI and SYSTEM.INI files that control the way Windows starts-up.  To keep your printer setup, video mode and fonts intact, you must hide the Control Panel.


The System Editor, SYSEDIT.EXE, is a utility that Microsoft decided to include with Windows, but hide it!  Normally, no icon is present in your Program Manager, and the executable is hidden in the \WINDOWS\SYSTEM directory.

The reason for this "stealth" is the power this application gives a user over the DOS boot files, CONFIG.SYS and AUTOEXEC.BAT, and several Windows INI files, notably WIN.INI and SYSTEM.INI.  It opens all these files for editing at once in a multiple-document window, allowing you to configure the computer environment.  To secure a Windows computer, follow Microsoft's lead: hide the System Editor!


The Windows Notepad utility, NOTEPAD.EXE, is a limited ASCII text editor.  It cannot open large files (only up to around 48kB in Windows 3.1) but will also open binaries if you ask it to.  However, many important files are plain ASCII text: the DOS boot files and all Windows INI files can be edited with Notepad.  Take note: hide the Notepad to control your computer.

For DOS versions above 5.0, there is a similarly capable program called EDIT.COM in the \DOS directory.  If you are administering a Windows computer, you should strongly consider deleting EDIT.COM; however, by disabling the ability to run DOS files, you can control this program's use.


Really, your Windows computer is still under the control of the program COMMAND.COM, source of the dreaded MS-DOS C> prompt.  Therefore, all mischief is available to those who type!  The saving grace here is that few people these days take the time to learn all those arcane commands.  However, the power is still there: hide the MS-DOS Prompt.


The Windows Setup Program, SETUP.EXE, is a truly remarkable program, perhaps the most important ever written for the IBM PC!  (After all, what would you have thought of Windows if its Setup program failed?)  Consider, it runs in both DOS character mode and in the GUI environment of Windows 3.x.  How many other programs do that?  (There are some, but few as remarkable as Setup, with its mode-switching, hardware detecting, self-configuring operation.)  In Windows mode, it allows you to switch drivers, which can disable the machine.  By itself, it's hard to cause too many problems with Setup, and it can heal itself (almost) from DOS.  HOWEVER: Setup also can allow your users to restore all the other programs mentioned in this section from its "Options" menu; so it's best you help your users avoid temptation: hide Setup!


Every time you start Windows, one program must be the shell program.  The shell is the program that controls when Windows starts and stops.  Microsoft's default shell is Program Manager, but the Microsoft File Manager can also be used as the shell, as well as many commercial and shareware applications.


Securing a Windows 3.1x PC running DOS against user modifications completely is approximately impossible.  The truth of the matter is, unless you remove or disable the A: floppy drive: anyone with a bootable diskette and an ASCII editor can completely modify a running PCs setup!  If the machine is protected by a power-up password and a locked case, the strength of the lock is all that separates someone from complete control of the machine, since the memory in the CMOS will fade in about two hours after the battery is removed.  And, when was the last time you checked whether your case is locked?