FOR
A cost-effective utility package to stop users from accessing programs or functionality that could corrupt the machine or the network.
AGAINST
Individual installation means it isn't really scalable enough for the larger corporation.
VERDICT
Perfectly suited for the home, school or small office environment, WinProtector is ideal for ensuring that users only see or use what they are supposed to.

Ask any network administrator what the most frustrating aspect of their job is, and many will place the blame fairly and squarely on the users. And they aren't being facetious; through gritted teeth they will tell you that they have lost count of the number of times that they have been called out to a user's desk, only to discover that the problem is self-inflicted. The blue screen of death or the frozen application is simply the result of users attempting to reconfigure their machines, or downloading some free software, or through their trying to install the latest screensaver, only to cause the PC to grind to a halt. Even more disastrous - as clearly demonstrated last year during the LoveBug outbreak - is when user interference can spread and damage other machines on the network. And if the corruption is too severe, that's the administrator's afternoon taken up with a re-build. Even something as innocuous as a new game can have a noticeable effect on productivity.

Obviously, there are many draconian measures that can be imposed to prevent this form of PC self-mutilation and to enforce security on a network: no access to the Internet, or the disabling of floppy and CD-ROM drives. Or each machine can be installed with a cut-down system build to ensure that the users simply cannot get themselves - or others - in a mess. But such options can have a number of undesirable side-effects. Firstly, users don't actually like it. If the machine doesn't allow them to do what they want, the temptation is always to find a way around the limitations: and the consequences of that could be even more severe than without the restrictions. People are people, and if they are told that they cannot do something, they will move heaven and earth to do just that. Secondly, many users actually do need access to the Internet, or access to parts of the network, or will need to use their floppy or CD-ROM drives, as part of their daily routine. Such restrictions will make them far less productive and damage the business.

Another solution would be customized system builds for each machine. But as any network administrator who has had to roll out even a standard build across a network can attest, even that is fraught and time-consuming. Not everyone has the same system requirements: managers may need one type of access, while data entry clerks will need another. Different builds for different groups would make the job of administering the network a living hell.

Thankfully, there are people out there who have realized this problem and have come up with a simple yet powerful solution. InVision's WinProtector (available in the UK from Guildsoft), allows you to enforce Windows configurations on individual PCs or groups of PCs, restricting what each user can do with both the operating system and with applications.

WinProtector allows an administrator to create customized access lists for each user or group of users, which only allow users to run certain parts of Windows or certain parts of applications. Once a user logs in through a password screen, they will only be able to use what the supervisor has defined.

Virtually every aspect of Windows can be disabled or hidden from the user. Worried about your users spending their time customizing their desktops? - simply disable Display Settings. Concerned that they will get into the system from the command line interface? - switch off the DOS prompt. Individual applications can be similarly doctored. You can also prevent users from placing too much of a drain on systems resources across the network by disabling the Run and Find commands, or from changing, deleting or corrupting files to which they shouldn't have access by preventing this on a user-by-user, file-by-file basis. Although there are many products which can offer either some or all of this functionality, very few come with a $51.95 price-tag.

One irritating deficiency in WinProtector is the lack of documentation in the shrink-wrapped package. A four-page quick install guide, although easy to follow, doesn't really give the impression of what the product can actually do. However, online help is sufficient, and the windows are fairly self-explanatory.

Initial installation is very quick and very simple - although this can multiply up very quickly if there are a large number of user groups to configure. Once the product is installed on the supervisor's machine, each different configuration is then saved onto disk: however, this disk then has to be run on each machine in the network to install the customized menus. Because of this, it isn't really suited to networks larger than a couple of dozen PCs, unless the user base and their responsibilities aren't going to change much over time and installation is going to be a one-off or quarterly occurrence.

WinProtector is a cheap and very simple way to reduce the network administrator's workload, but, just as importantly, limit the amount of damage that users could inflict upon your system. Whole swathes of Windows functionality that could be used to bring a machine - or a network - come crashing down can be hidden without time-consuming rebuilds or systems changes. It also has the ability to limit the amount of time spent on each PC: perfect for parents who are worried about their children's access to the Internet. If you have a smaller network - such as a school or an office, or even just a standalone home machine - and want to ensure that users can only do what they're supposed to do, WinProtector is the ideal solution.
 

SC On-Line
SC Magazine
www.scmagazine.com