Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Problem: It is super easy to bypass K9 Web Protection by renaming a file in the Windows\System32 directory in Windows 7.

Question: How do I prevent an admin user from renaming said file in said directory, thereby bypassing K9 Web Protection? OR, if I can't do that, how do I enable a standard user to install programs.

share|improve this question
Meta-question because I know someone is going to ask: This is for self-monitoring purposes. I want to be able to install programs, and remove them, such as games in Steam without having to get permission from someone else. But I don't want to be able to bypass K9 Web Protection. – Dave Kennedy Jan 22 '13 at 5:25
Is this in a workgroup or a domain setting? – Julian Knight Jan 22 '13 at 8:26
Sorry if I don't understand your question, but it is a single PC on my home network. I have other devices on the network as well, but this is the only Windows box. It does have a workgroup, which is just "Workgroup". – Dave Kennedy Jan 22 '13 at 16:44
That's OK, you've told me what I need to know. That your setup is not part of an enterprise Windows domain. – Julian Knight Jan 23 '13 at 21:33
up vote 3 down vote accepted

I actually can't think of a reliable way to do this as stated I'm afraid.

Perhaps someone with better Windows security knowledge knows of a way but as far as I know, a user with Admin rights on a non-Domain (stand alone) computer can do anything they want to if they know what they are doing.

You could try to fool Windows into adding the file into the list used by the Windows File Protection feature. But I've no real idea if this is workable. A determined person would still be able to delete the file if they really wanted to.

With regard to the second part of the question: you can't I'm afraid. Not on a stand alone PC.

If you really need protection on one or more computers, you need to make them part of a Windows Domain. Windows Domain's are able to enforce security policies of many kinds. This includes required software & services to be running, files and folders that are protected, limited administration rights and so on. To do this, you need to run at least one physical or virtual server and there are license costs too.

For your purposes though, a much better option that avoids running up an entire Windows domain would be to create a "transparent proxy". Basically, you set your router or firewall to only forward traffic to the Internet if it goes via your proxy. You run your filters on the proxy. Anyone who tries to bypass the proxy doesn't connect to anything useful. Set up DHCP (either via your router or from the proxy) so that PC's connecting to your network automatically have a "default gateway" pointed at the proxy and possibly filter all DNS requests through it as well. Of course, you still need a spare PC to do this and it may need to be a reasonable one if the traffic to the Internet is heavy.

UPDATE: Having read the other referenced thread re transparent proxying, I can see that your other problem was due to the lack of SSL support in TinyProxy. So don't use that if you can. If you have a PC that you can configure as a proxy, that would be best though to do it best, you need two ethernet ports. Even an old laptop would do the job, add a PCMCIA or USB ethernet adaptor as the second card. On a desktop, it would be easy, many desktops actually have to ethernet ports already. Have a search on Google on how to set up SQUID on Linux or even Windows (if you must) as a transparent proxy. With that set up, you will have no problem proxying and filtering SSL connections.

share|improve this answer
I'm glad you brought up the whole transparent proxy thing. That's what I was working on before I gave up and resigned to just use K9 because they've already figured all that stuff out. (In fact, it seems like Blue Coat are the only ones who have figured out transparent HTTPS proxying.) Realistically, I don't think it's possible to proxy SSL traffic at all unless you're willing to pay out the ying yang for their enterprise security suite. Anyways, I hit a brick wall on that thread but maybe you could help get me unstuck:… – Dave Kennedy Jan 24 '13 at 4:50
Just to keep this thread complete: you can proxy SSL, but filtering is harder. You have to do a "man in the middle" process by dynamically swapping out certificates with your own. Not easy and AFAIK, as you say, reserved for commercial software only. – Julian Knight Jan 24 '13 at 6:52
Read the other thread. I'll see if I can comment later. I think that simply filtering by URL should be simple enough as SSL doesn't encrypt that part. You can certainly do that on some none commercial proxies. It's only content filtering that is hard. – Julian Knight Jan 24 '13 at 6:55
@davidkennedy85: See my update above that I think may answer your proxy question, I'll also add a note on the other question. – Julian Knight Jan 24 '13 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .