Restrict an Application's Process Rights
This scenario describes the process involved in restricting an application's process rights. This sample scenario , and guides you through the necessary steps , using the default Limit Internet Explorer and Outlook process rights policy.
Scenario Description
In this scenario, the end user hasInternet Explorer inherits administrative rights from users and is therefore able to stop Windows services, with the following configuration:
- Internet Explorer installed
- A user account with administrative rights
- Network Messenger Service enabled and running
With this configuration, To prevent Internet Explorer has inherited administrative rights from the user and is therefore able to stop Windows Services.
Scenario Resolution
To access the Application Control Policies page:
...
from stopping Windows services, perform the following steps:
- In the Security Manager Console, click the Policies tab
- In the file library in the left pane, navigate to Application Control > Policies> Privilege Management > Limit Internet Browser and Mail Client Process Rights.
...
- In the right pane, enable the
...
- policy by
...
- clicking the On/Off toggle.
- Open Internet Explorer, select File > Open, and then browse to cmd.exe in the SYSTEM directory.
- Attempt to stop the MSN Messenger service using the command line: NET STOP Messenger.
An Application Control message appears on the taskbar stating "IEXPLORER.EXE has had its rights reduced" and you are unable to stop the service.