Welcome!
The Lock:

Comprehensive Windows 95 Workstation Protection

This program is Shareware.

If you like this program please  send your REG ID (from the

registration page of Help/About) , Email address,  registration fee,

and any comments to:

CrashCourse Software

attn: Rob Boulden

1007 South Lewis

Stillwater, OK 74074

Be sure to Include your Email address for quicker response.

Fees:

Single User License:

Software downloaded from Internet:	$25.00US

Software mailed on floppy disks:              	$35.00US

Software mailed on floppy disks with DOCS:	$40.00US

Multiple User License:                     	Email for details

Modified/Specialized versions of The Lock:	Email for details

WWW:

http://www.theknow.com/CrashCourse

FTP:

ftp://ftp.theknow.com

Email:

CrashCourse@theknow.com

Support:

CrashCourse@theknow.com

The Lock provides password protection for the Windows 95 platform.  It can be configured to accept multiple  logins, as well as setup definable restricted access to the Windows 95 machine depending on username.  Restrictions include limitations to program usage, file access, logins, and time period usage, all Admin configured.  The Lock now has the ability to validate a users password locally,  through a Novell Network Server (BIND or NDS), a Windows 95 dedicated validation system, or a Windows NT domain server.  (Win95 Validation System and Windows NT require the CrashCourse Network Validator, a freeware utility from CrashCourse Software).

All menu items are accessed through the tray icon pop up menu.  To access this menu, right click on The Lock's icon in the system tray.

Menu Options: (accessed through icon right click or panel menu)

Security:

Options Menu:

View Menu:

Help Menu:

The Lock Notes:

Modes of Operation:

Password Validation Configurations:

General Security Issues:

Example Startup Files:

Example Profile:

Uninstall:

Special Thanks:

Copyright 1996, 1997

CrashCourse Software

All trade names mentioned are registered by their respective owners.

                                   .


Modes of Operation

The Simple Lock.

This is the basic Password locking mode.  In this mode, you may use the master password or the Admin password (make sure you customize it).

The Lock.

This is the standard Password locking mode.  In this mode, you may use the master password, the Admin password (make sure you customize it), Novell Passwords or CrashCourse NetVal Passwords.  If Multiple users are enabled in The Lock Options page, the user name may also be altered on this window to log into the workstation as a different Lock User.  If the system is configured for multiple users, the user name may be entered along with the password.

User Profiles

When The Lock is configured for multiple user profiles, different users may have different security rights.  In this mode, the system will act in its normal fashion, however, The Lock's System Monitor will be active the entire time.  When in this mode, it will require the Admin password alter any of The Lock's configuration items.  As users log in, their security profile will be determined by the Admin's profile list.  If the user does not appear on the profile list, the profile level will default to 10.  Depending on the specific user profile, and the kill file list, different options may or may not be available to the user.

Such options would be the shut down options.  If the user shuts down the system, The Lock will show a prompt with a list of options for Windows shutdown.  Shutdown will not continue until the user makes a selection; this will offer a higher level of protection by not allowing The Lock to exit until Windows is about to close itself.     Locking the Start Menu will not allow the user to access any Start Menu items.  The amount of time a user may access the system may be specified as unlimited or any time between 10 and 90 minutes.

While running in this mode, if a user closes The Lock by pressing CTRL-ALT-DEL and selecting Close Program The Lock will be restarted, and the system then locked.

Back to the top.

                                   .


The Lock Notes

The default Admin password is :PassWordCrash, it is case sensitive.

The administrator may change the Admin password altered by selecting Security/Change Password from the pop up menu when they are logged in as the Admin.  Once changed, only you will know the Admin password.  This will offer a second level of protection.   It is STRONGLY recommended that you change the Admin password from it's default of "PassWordCrash".    When the system is in total protection mode, the Admin password is required to change any major aspect of The Lock and to log out of the current session of The Lock.

Back to the top.

                                   .


View Menu

View Message File to view the last message file.  Persons may leave a message to you while the

lock is running by tabbing to the Leave MSG button and pressing enter, or by pressing ALT-L .

The messages are dated and timed.

While being viewed, the message base may be deleted.

View User Info View the current users login information.

Back to the top.

                                   .


Options Menu

Lock Config.

User Options:

Admin Options:( Login using Admin Password or select Admin button on Options page)

Administrate.

Admin Lock System: Used to lock the system requiring the Admin Password to unlock.

Write MSG: for other users to view when attempting to log into The Lock.

Start the Security Wizard: This is a step by step guide to protecting your system.

View Log File to view the last log file.  All attempts to enter a password are logged with the

password that was tried, with the exception of the correct password.   In addition to the password attempts being logged, most every other entry item concerning The Lock is logged also.  (This includes password changes, messages viewed, log file viewed, etc.)   You may also load previous logs by pressing the Load Log File button

Help to activate this help file.

Misc Config-

Screen Saver Config:  Start the Windows 95 screen saver utility and allow the current screen saver to be changed.

Win IP Config:  View the current IP configuration for the system.

Back to the top

                                   .


File Menu
Security Menu

Lock System to activate switch to password protection mode.

Log Out will activate password protection mode, but will remove the User Name if Multiple Users are enabled.

Change Password: to change the users Lock Password. If the Administrator is logged in, selected this option will change the Admin password.

Exit this menu item will close The Lock.

Back to the top.

                                   .


Lock Password
User Password

This is the standard user login password.  It will be linked to the current Windows 95 user name if the system is in single user mode.  Activating Multi user will allow multiple users to run The Lock on the same machine.  (Each user must have their account activated by the Admin user if local password validation is being used, or they should use Novell validation, or The CrashCourse Network Validator.)

                                   .


User Info

Back to the top.

                                   .


Special Thanks

CrashCourse software would like to thank the following individuals for their suggestions, comments, and input:

Mike Cremin

Biff Stephens

Brad Buxton

Joel Swift

Kelly Tice

Chris Lenderman

Richard Kent

Michael Callahan

Back to the top.

                                   .


Edit Files
Restricted Programs

Adding files to Restricted file list.

In the Classes edit blank, enter the class name of the Window to monitor.

A * may be entered to monitor all window classes for a specified title.

In the current title edit box, enter the name of the window to not allow operation.

A * may be entered to monitor all window titles, a * and part of the title will monitor any window with that part of the title in it.

Examples:

Open My Computer, browse to C:\Win95 (if Windows is in a different directory use that instead)

Open Lock Config, select Profile, select DisAllow page.  Click Capture button.  Click on the My Computer window.  The information from the My Computer window is now added to the Capture window.

Click Done.

The followeing data is now entered into the Kill File list (item number one is what is entered, items 2, 3, and 4 are modifications made to change the results)

Class name:	 Window Title	Close Action

CabinetWClass	 C:\Win95	Any window with class CabinetWClass and title 'C:\Win95'.

CabinetWClass	 *	Any window with class CabinetWClass and any title

CabinetWClass	 *win95	Any window with class CabinetWClass and win95 in the title.

*	 *win95	Any window with any class and win95 in the title.

Button Information:

Remove all: 	Remove all window data.

Remove:	Remove current selected window data.

Add:	Add current window data.

Clear:	Clear current edit boxes.

Capture:	Launch the window capture utility.

Using the Window Capture utility.

Select Capture to activate the Window information capture utility.  While this utility is running, select any open window that the system should not allow to operate, then press any key.  The window title and window class will now be entered into the appropriate edit boxes.  Click OK and the items will be added to the

monitor list, or click Cancel to ignore the information.

Copy:  Use this button to copy the current kill file data for use in a different profile.

Paste:  This button will paste the copied kill file data into the current profile.

Back to the previous.

                                   .


General Security Issues:

The following nine security items must be addressed in order to ensure maximum security for the system.

1.  Physically secure the computer:  Use a locking case, or a locked closet.

2.  Protect CMOS with a password.

3.  Disable booting from the A: drive.

4.  Boot directly into Windows 95.  If multiple configurations are needed, use The Lock for DOS to protect the boot process.

5.  Auto load The Lock with Windows.  Auto lock when The Lock is loaded.

6.  Be aware of any network connections to the machine.  Only share those resources that are needed by outside users.

7.  Always be aware of the different user profiles and the amount of security they offer.

8.  Always use the idle detection timer to automatically lock the system.

9.  Never leave the machine un-attended without locking it first.

Back to the top.

                                   .


Uninstall

Exit The Lock:

Start Control Panel (Start button / settings / Control Panel)

Double click Add/Remove Programs.

From the list choose The Lock 97 Uninstall

Press Add/Remove

                                   .


CrashCourse Net Val

This option works in the following method.

On a network running Microsoft Networking, with multiple machines, one machine will be configured as the CrashCourse Network Validator.  This machine will run the CCNETVAL program and the user of this machine will be The Lock's Network Administrator.  The user of this machine will setup the initial user names and passwords for each user on this network.

Once this is completed, the  network administrator will then share as a full access resource the CCNETVAL\ROOT directory.

Each workstation version of The Lock will have this drive mapped as a permanent connection.  The Admin personnel will then configure each workstation to look for the ROOT directory on the CCNETVAL machine (CCNETVAL\ROOT).  This must be done by selecting the Path button on the Login Options page.  Browse to the shared resource and double click the only file listed in that directory.  CCNETVAL MUST BE RUNNING ON THE VALIDATOR MACHINE WHILE THE PATH IS BEING SET FOR EACH WORKSTATION and at all times after that point.

Once this is completed, select the Use CrashCourse Net Val checkbox on the Login page, and that workstation will then use CCNETVAL as the password validation agent.

This method will allow networks with multiple systems to have a standard login for each machine allowing any person to login to that workstation.

Note:  all station login's are monitored and recorded by the CrashCourse Network Validator.

All passwords on the CCNETVAL machine are encrypted, and each user may change their own CCNETVAL password on the

workstation that they are logged into.

back to previous.

                                   .


Password Validation Configurations

Password Modes:

User Mode:

This is the standard Log in mode.  In this mode, with Sys Mon enabled, the logged in user may access normal settings, and programs, but are locked out of any programs designated by the Admin using the file limitation utility. (Options page)

Admin Mode:

This is the administrator mode.  In this mode, the settings for The Lock may be altered, as well as passwords and other security options.  This mode may be entered by typing the Admin password at any password dialog box.  The machine may be configured to recognize the local user as the machines user.  When that user logs in, the system will automatically enter admin mode.  This is enabled by selecting the "Local user login is Admin" option on the Lock Config /Startup page.  Ex.  If this is your machine, when you log in, it will enter Admin Mode automatically.  When password protection is started again, the system will revert to user mode.

User Modes:

Single User is Administrator.

In this mode, the system user would install The Lock, and configure the Admin password and settings, and User password as they would find most fit.  (System Monitor Mode will offer highest degree of protection).   This option is best to keep relatives or room mates out of your system.

Single User is NOT Administrator.

In this mode, the Administrator would install The Lock, and configure the Admin Password and any necessary Admin Settings.  They would then configure the initial user and password.  Upon completion of this task, The Administrator would put the system into System Monitor Mode.  The Administrator could then configure any Window Classes or Window Title that should not be allowed to run on the machine.  The user would then login to the system using the initial user password supplied by the Administrator.  The user would then customize their password.  This is best to allow specific usage of a machine by the single user for each machine, while offering complete usage to the administrator.

Multiple User Systems.

In this mode, the Administrator would install The Lock, and configure the Admin Password and any necessary Admin Settings on a single machine.  Each machine would be configured to use Multiple Users.  The Admin would then configure the initial user and password for each machine, for each user.  Upon completion of this task, The Administrator would put the system into System Monitor Mode.  The Administrator could then configure any Window Classes or Window Title that should not be allowed to run on the machine.  The user would then login to the system using the initial user password supplied by the Administrator.  The user would then customize their password.  This is best to allow specific usage of a machine by  multiple users, while offering complete usage to the administrator.

In each of the above cases, the password  is validated on the local system.

Network Modes:

Systems with Novell.

On systems running Novell Netware 3.x or greater, the Admin will configure the system in one of the configurations listed above.  They would then add the file NWCALLS.DLL to the Windows System Directory, or install Netware Client 32.  Within The Lock Options, on the Login page, the Admin would check the Use Novell Validation checkbox.  If this option is not enabled, it is because the correct Netware drivers are not installed.  Once this is completed.  The machines will then validate the user against their Novell Netware Account.

Systems with the CrashCourse Network Validator.

On systems running in any sized Microsoft Network, using pier to pier networking, the Admin will configure the system in one of the configurations listed above.  They would then configure one of the systems (usually the Admin's system) to be the Network Validator.  On this machine, they would run the CrashCourse Network Validator utility (CC Net Val).  Before configuring any workstation, the Admin would add each user with their initial password to the CC Net Val utility.  Within The Lock Options, on the Login page, the Admin would check the Use CrashCourse Net Val checkbox.  If this option is not enabled, it is because CCNETVAL is not running on the designated machine, or the resource CCNETVAL\ROOT is not being shared.  Once this is completed, and all users have been entered.  The workstations will then validate the users password against CCNETVAL utility.  As each user changes their user password, it is changed on the CCNETVAL machine, not the local machine, so the CCNETVAL\ROOT shared resource must be shared with read/write access.  The CCNETVAL utility may also be used on a Windows NT server.  In this situation, it is installed and setup as above, but Windows NT is selected as the validating device.

Back to the top.

                                   .


Security Profiles
User Profile Utility

Users:

Group Rights:

Restricted Programs:

Allowed Programs:

Locked Files:

Previous Help

Back to the top.

                                   .


MSDOS.SYS

The items in red are comments:

This files must be attribed to be edited.  At the DOS prompt type:

ATTRIB C:\MSDOS.SYS -R -S -H

then type EDIT C:\MSDOS.SYS

The following file will appear:

[Paths]

WinDir=C:\WIN95

WinBootDir=C:\WIN95

HostWinBootDrv=C

[Options]

bootkeys=0 {usually set to 1 which allows F5 and F8 keys}

bootmulti=0 {usually set to 1, this allows booting to the previous version of DOS}

bootmenu=0 {usually set to 0, if it is 1, it will post the BOOT MENU upon system boot-up}

bootgui=0 {usually set to 1 and forces the Windows 95 GUI to load}

BootDelay=2

Logo=1  {if this is 1, the Windows 95 boot logo shows during boot up)

BootWarn=0

BootMenuDefault=1 {if this item is 1, it will prevent safe boot)

;

;The following lines are required for compatibility with other programs.

;Do not remove them (MSDOS.SYS needs to be >1024 bytes).

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxa

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxb

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxc

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxd

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxe

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxf

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxg

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxh

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxi

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxj

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxk

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxl

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxm

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxn

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxo

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxp

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxq

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxr

;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxs

CONFIG.SYS

The items in red are comments:

type EDIT C:\CONFIG.SYS at the DOS prompt

install=c:\win95\dlock.exe c:\progra~1\crashc~1\thelock c:\win95 /n /m /v {this item loads the Lock for DOS validation units}

switches /f /n {this item disables the F5 and F8 boot for MSDOS startup}

device=c:\win95\lock95.sys  {this item loads The Lock for DOS}

[menu]

menuitem=win95g,Windows 95 GUI

menuitem=win95d,Windows 95 DOS

menuitem=clean,Clean boot

menudefault=win95g,30

[win95g]

[win95d]

device=c:\win95\himem.sys /t:off

device=c:\win95\emm386.exe RAM

dos=high,umb

DEVICEHIGH=C:\CDROM\SBIDE.SYS /D:MSCD001 /P:170,15

[clean]

[COMMON]

AUTOEXEC.BAT

The items in red are comments:

type EDIT C:\AUTOEXEC.BAT at the DOS prompt

@echo off

goto %config%

:win95g

set path=C:\WIN95;C:\WIN95\COMMAND;c:\dos;c:\exe;c:\bat

win

:herewin

goto herewin

:win95d

set path=C:\WIN95;C:\WIN95\COMMAND;c:\dos;c:\exe;c:\bat

lh C:\WIN95\COMMAND\mscdex.exe /d:mscd001 /e

lh lmouse

smartdrv;

goto end

:clean

set path=C:\WIN95;C:\WIN95\COMMAND;c:\dos;c:\exe;c:\bat

:end

:winlock95

c:\progra~1\crashc~1\thelock\locked01.exe  {this item loads The Lock for DOS}

if exist c:\l.win win.com

if exist c:\l.win goto winlock95

Back. to the top.

                                   .


Example Profiles

Configure The Lock to use Multiple User Profiles by following the following example:

Start The Lock.

Right Click on the Lock Icon in the task bar.

Select Options, then Lock Config from the menu.

Press the Admin button to login in Admin mode.

Lock Config:

Select the Startup tab.

Make sure Enable Demo Mode is not checked.

Select the Login tab.

Check Allow Multiple Users.

Make sure Use Novell Password Validation and Use CrashCourse Net Validation are not checked.

Select Administration tab.

Make sure Use Basic Lock is un-checked.

Select User Profiles  tab.

Make sure Use User Level Profiles is checked.

Set SysMon Validation Interval  to minimum time setting.

Click Edit Profiles Button.

User Profile Utility:

Select Admin tab.

Click Import Profiles button.

Select EXAMPLE.UPF from the Open Dialog Window, Click OK button.

The lock has just loaded a five user profile.  The user names are user0 - user5, their passwords are password0 - password5 respectively.  Their user leves are from 10 - 15 respectively.  If you log in as user0, your password would be password0, and your user level would be 10 (10 is also the default user level).

Click on user0 in the profile list (the user name is followed by their user level).

Select the Profiles tab.

This tab shows the current users for this level (in this case there is one user, user0).  It allows you to add users, remove users, set user passwords and set various options for this user level.

In our example, the  user level 10 is heavily restricted by the following:

Lock Start Menu (user may not access the Win95 Start menu)

Lock Config Files (Config.sys, Autoexec.bat and various other setup files are not accessable)

Hide Desktop (the desktop icons are hidden in this user level)

Hide System Tray (the system tray is not accessable)

DisAllow Files (explained below)

Allow Files (Explained below)

Limited User Time (users at level 10 only has 10 minutes to use the system)

Select the Allowed tab. (one method of program restriction)

This tab shows the program items that will be allowed to run at this user level.

The items in the Allowed Windows list, are the only programs that the user is allowed to be running when the system is unlocked ( the user logs in).

The items in the Available programs window are the programs that are available for all the users (the Allowed Programs window is the list that is available for this user level only).

When you press the Browse button, an explorer window will open up.  Browse to the programs you would like the user to access.  Example:

Press the Browse button, and browse to the Windows directory, drag CALC.EXE to the Available programs Window.  There is now a CALC added to the Available Windows list.  Select CALC and click it once to edit the name.  Change it to MS Calculator and press enter.  Drag it to the Allowed Programs window.  Now users with Level 10 access will be able to view info.txt and run MS Calculator.

Select the DisAllowed tab. (one method of program restriction)

This tab shows the programs that are not going to be allowed to run.

The items on the left are the Window Class and the items on the right are the Window Title.  These two items tell The Lock what windows to allow and what windows to not allow.

In our example at Level 10, the following is known by The Lock.

If you open a window with class #32770 (standard Windows Dialog class) and the title has the word Options, prop or run in it, the window will be closed. (the title is not case sensitive, so RUN is the same as run).

Further, any window of class CabinetWClass with title * (meaning any title at all) will be closed.  This class is actually the class for the My Computer and Network Neighborhood icons.  They will be closed upon starting to browse.

The same is true for the ExplorWClass (Explorer.exe windows) and SYMCP4_FileMgr (Northons File Manager)

Now, we are going to add a window to the DisAllowed List.

Click Win95's Start button, select Programs, Accessories and click on the Calculator icon.

Calculator is now started.

Next, click on the Capture button on the DisAllowed page of the User Profile Utility.

Click on the Calculator Window, then move the cursor over The Lock's Capture window.

The information for Calculator is now added to the Capture window.  Press the Add Button, then the Done button., now the info is added to the DisAllowed Windows list.

Click Apply then click OK on the User Profile Utility.

Click OK on the Lock Config dialog.

Next follow these instructions. (read them all before doing them)

Double Click The Lock icon in the system tray.

Select the User Name edit box, enter user0

Type password0 as the password.

You will be presented with a window containing Item.txt and MS Calculator.

Double Click Item.txt, and Notepad is opened with the text.  Close it.

Double Click MS Calculator, it is opened then closed. (if it is not closed, make sure you un-checked the Use Demo Mode checkbox of the Startup Page in  Lock Config.)

Select Exit from the menu to logout.

Enter your user name and your Admin Password to access the Lock Config as before.

Next try user1, user2 etc to get a feel for the different options and different restrictions available.

Back to the top.

                                   .


User Options

Start Windows Screensaver on Lock:  When password mode is activated, the  Windows Screen Saver, if any are installed, will be started.

Blank Screen on Lock: When password mode is activated, the screen will blank.

None:  	The blank screen will be displayed with a black background.

BitMap	Select a Bit Map to display on a black background.

Text:	Enter the text to display on the background, double click to edit the font used for displaying the text.

Show System Information Panel: View the current status of The Lock, including user information.

Show  System  Information Menu: Displays The Lock's user menu on the System Monitor Panel.

Reset Panel: This will set the System Information panel's display position to the upper left of the display.

Lock after Idle Time: Automatically lock the system after it has remained idle for a specified length of time.  Use edit box to adjust the maximum idle time.

PassWord Dialog Auto hide:   Hide the password dialog box after the determined amount of time, until the user move the mouse or types a key.

Enable User Options:  This is an admin option to enable and disable the users ability to edit their settings.

Back to Previous.

                                   .


Admin Options

Start:

Login:

DOS:

Misc Config:

Hot Keys:

Administration:

Back to previous.

                                   .


Start

Load The Lock with Windows: Load The Lock upon Windows startup.

Auto Lock when loaded: Automatically put the system into password mode when The Lock is started.

Show Help on Password Login:  Display a help button on the main login screen.  This is useful for new and initial users.  It is recommended that this option be disabled after Lock configuration is complete.

Show Cancel button on Admin Login: Add a cancel button when the Admin Password dialog is started.  This is useful on systems where the user may have a tendency to start the Admin Password dialog by accident.  If this is enabled, the user may cancel out of the dialog.  If it is not enabled, the Admin will have to type the Admin Password to close the dialog.

Enable Demo Mode:  Remove most of the protection processes used The Lock.  This mode is only good for initial demonstration and customization of The Lock.  It will give new users the ability to play with The Lock and not lock them selves out of the system.

Enable Log File: Enable or disable The Lock's log file.  When the log file size grows to be greater than 64k, the file is automatically copied to The Lock’s install directory.  The file name is the current date and a .log extension.  Each user is stored in the file under their specific user name heading.

Hide Hidden and System Files on Startup:  Allows Windows 95 to automatically switch to hidding hidden and system files upon bootup.  In addition to hiding these files, it is a good idea to use the System Monitor and capture the options window used to change between hiding and showing hidden files.  (Click on My Computer, select View, then Options.  Pick View page.  The first selections will switch between hiding and showing hidden files.

Use The Lock's Splash-screen on startup: Enable or disable The Lock's splash-screen upon program startup.

Back to Previous.

                                   .


Login

Novell Validation:  Will allow The Lock to validate user passwords through a Novell network.  (this feature requires NWCALLS.DLL to be in the Windows System directory, or Client 32 to be installed on the system.

Use CrashCourse Net Val: This will allow validation of the users password through the CrashCourse Network Validation utility (a freeware separate utility).     This utility can validate against a user name/password database, or a Windows NT server.

Windows NT Login Domain:  This is the domain used for Windows NT login validation.  It is usually set by the system, but may be edited to the correct Windows NT domain.

Validation Timeout:  Validation timeout is the amount of time The Lock will wait for a response from the validation server before it switches The Lock to local validation mode.

Admin Lock after: This option will automatically put the system in Admin mode after a failed number of attempts.  This mode will require the Administrator password before the system can be unlocked.

Prevent User Password Modification: Enable or Disable the users ability to change their password.

Win Login required for Access: This option will force the user to log into Windows 95.  Pressing Cancel on the Windows login screen will cause the user to be logged off, then back on again.

Auto Logoff on System Lock: Automatically clears the User Name entry blank when the System is locked.

Back to Previous.

                                   .


DOS

Enable DOS Startup Protection: Use this option with great care.  It will remove all DOS protection built into The Lock..

Use The Lock for DOS: Protect the system bootup while CONFIG.SYS and AUTOEXEC.BAT are being processed.  The Lock for DOS accepts the Admin password  or any users password that has been configured for use in DOS.  If this option is disabled, The Lock will still protect the boot process.

Accept Admin Password Only:  If this option is checked, the admin password is the only password that will be accepted in The Lock for DOS.

Accept Any Password Configured for DOS:  Using this option will allow any user to enter their password in The Lock for DOS if they have a password configured for use in DOS.  If no users have a password configured for DOS, no password will be required.

Allow DOS Lock timeout:  If The Lock for DOS is used, it will time out, and continue to boot after 10 minutes.  If this item is unchecked, The Lock for DOS will not time out.

Lock Out DOS Boot Keys: Disable the DOS boot keys. (F5 and F8, etc.).

Lock Out Win95 Boot Keys: Disable the Windows 95 boot up keys (shift f5, shift f8, f5, f8, etc).

Back to previous.

                                   .


Misc Config

Use Quick Batch After: Automatically execute the programs listed in the files to execute drop down box after a number of fail attempts.

WARNING:   Use  this feature with great care.  The Lock 97 will execute any Windows or DOS program that is entered into the list box, including DOS BATCH (.bat) files.  No warning window is presented, and the programs may be run in hidden mode thereby not alerting the user to their operation.

Files to execute: This dropdown box contains the list of file that will be executed upon a predetermined number of login attempts.  If the dropdown box is blank, the button to the right will read Add File.  If the dropdown box contains a file name, the button to the right will read Del File.  Any file (DOS [exe, bat, or com] or Windows [exe]) may be added to the list up to a total of 5.

Run Hidden: This option will execute the files in hidden mode.  Their icons will not display on the system bar and they will not show up in the task switcher.

Show Tool Tips: Enable or disable the control tool tips for The Lock.

Show Close Window Message:  Allows a message to show when the user opens a window that is closed by the Monitor.

Use Logon Greeting: Use this option to display a message to the users that successfully logon to the system.

Back to previous.

                                   .


Hot Keys

Lock Hotkey:  Start The Lock Protection in Standard Mode using a hotkey.

Admin Hotkey:  Start The Lock Protection in Admin Mode using a hotkey.

Config Hotkey:  Start The Lock's Configuration Utility using a hotkey.

Exit Hotkey:  Close The Lock using a hotkey.

Back to previous.

                                   .


Administration

Use Simple Lock: This option will active The Lock protection in Simple Lock Mode.

Administrator's Login ID:  This is the user name required to enter Admin Mode.

Login at Admin Level by Default:  This option will allow The Lock to enter Admin mode (user name will have Admin Mode printed after it), allowing access to configuration settings, when the local user logs in.  The local user is the person who is logged into Windows 95 on that machine.  Any other user logins will be in normal user level mode.  This option is not recommended for multiple user systems.

Activate User Level Profiles: This option must be selected to enable User Level profiles.

Allow Multiple Users: Select this option to allow multiple users to log into The Lock with their own user names.  If the system is not configured for Novell Validate or CrashCourse Net Val, each user must have their account set up locally.

Profiles button (Configure User Security Levels)

Sys Monitor Validation Interval:  This slider setting will determine how often The System Monitor will check for windows that are listed in the file limitation data and need to be closed.    The higher the setting, the less system resources are used, but some windows may take up to one second before they are closed.

Enable Open/Save Dialog Box Protection: This option works in conjunction with Restricted programs (from the User Profiles Page).  When in this mode, The Lock will search all Open and Save dialog boxes for any directory text that has a Window class *, CabinetWClass or ExploreWClass and a single directory title.

e.g.  You want to block access to the Windows System directory.  A correct entry in Restricted programs would be:

Window Class:	Window Title

     *                          	*\system	or

CabinetWClass	*\system	or

ExploreWClass	*\system	not

    *	*\windows\system

If it finds any Dialog box information to match the items, the dialog is closed automatically.

Since Windows 95 native filename dialog boxes do not list the entire path, the Window title to search for must only have one path element.  Windows 3.1 native dialog boxes do not have this limitation.

When configured correctly, the user can not access protected directories with any program.  (MS Word for Windows 95 has some powerful file manipulation built into its open and save dialogs.)

Display warning before closing dialog: Show the user a warning before closing their open dialog, giving them a chance to exit from the current locked directory.

Back to previous.

                                   .


Users

Complete User List:  This list contains all the users configured for the system, their passwords, and their user level.

Options:

Double click a users name to change the Group Level to that users level.

Use the Group Level Control to change to any level from 10 - 99.  Select user(s) from the Complete user list and drag them into the Curren User Level List

Current User Level List :  Enter users for list profile level into this list. (Right Click for Pop Up Menu)

Delete All::  Deletes all current level users.

Delete:  Deletes only the selected users.

Cut::  Cuts only the selected users to the clipboard.

Paste:  Pastes the clipboard selection to the current group level..

Name:  Enter the desired user name.  Press enter to add to the current group level list.

Allow User's password in DOS Add any users that will be allowed to log into The Lock 97 for DOS (if this utility is being implemented on the system.)  A * by the users name indicates access to DOS.

Set Password :  Press this button to set the password for the selected user.

Auto Set Pass:  Use this option if you are going to be entering multiple users, and want to set the password for each one as you enter the name.

Back to previous.

                                   .


Group Rights

Allow restart to MS-DOS mode:   This option will allow the user to restart the system in MS-DOS mode.  WARNING:  THE SYSTEM IS NOT PROTECTED IN MS-DOS MODE WHEN ENTERED THIS WAY.

Require Admin Password for Windows Shutdown:   If this option is checked, the Admin password is required to restart Windows 95.  If this option is not checked, the system may be shutdown, restarted, or have a new user login, but the Admin password is required to restart in MSDOS mode.

Allow Windows Shutdown Only:   When a user logs in, and their profile has this option checked, they will be presented with the Windows shutdown screen.  Use this option will all the other limitation options, and the logged in user will only be able to shutdown the system.

Lock Start Menu:  This feature will automatically interrupt the use of the Start Menu.

Lock Config Files:   This option will lock the key system configuration files.   These files may not be altered while they are locked.  Such files include CONFIG.SYS, AUTOEXEC.BAT, MSDOS.SYS and any Lock configuration files.

Hide Desktop:  This feature will hide the desktop icons when the user logs in.

Hide Taskbar:  This feature will hide the task-bar when the user logs in.

Activate Restricted Program Options: Use the Disallow files configuration.  (These programs will not be allowed to operate.)

Activate Allowed Program Options: Use the allowed files configuration. (These are the only programs that may be run.)

Activate Locked File Options: Use the allowed files configuration. (These are the only programs

Activate Virtual Programs Folder: Use the Set button to the left to build a custom Programs folder (press Start Button, Programs Folder is listed in the menu).  This will give the ability for each group level to have a custom Programs Folder.  Note: This option has no affect on any other Start menu options.

Activate  Virtual DeskTop: Use the Set button to the left to build a custom Desktop folder.  This will give the ability for each group level to have a custom Desktop Folder.  Note: This option has no affect on any Standard Windows 95 Desktop Items (My Computer, Recycle Bin, etc.)  It is basically used to add your own programs to the desk top for each group level.

Example:

Limited User  Time: Change the amount of time that Sentry Security will be active before re-locking the system.

Max Logins Allowed: Total number of times the current user level may log into the system.

Logins Remaining: Total number of remaining logins for the current user level.

Only Allow Logins Between: Use this option to specify the time-period that a user may be logged into the system.  The time is displayed as Login Time - Logout Time (HHMM-HHMM).  The time specified is military time.  Example:  8:00AM to 5:00PM is the allowed login time for the current user level.  The time representation for this period would be 0800-1700.  If a user logs in before or after their allowed time, they are logged out.  If the user is logged in, and the time reaches their logout time, they will be presented with a 10minute timer, after which they will be logged out automatically.

Group Name: This is the current level identification name.

Export Profile: save the profile database to a file for use on other systems running The Lock.

Import Profile: Load and use a profile database configured on another system running The Lock..

Delete Current Profile: Clears the current profile, resetting all items to default settings.  All users in this level are dropped to the default level (Level 10).

Delete All Profiles: Clear all profiles, resetting all items to default settings.

Set Admin Password: to change the Admin Password.  (Default is PassWordCrash and is case sensitive)

Security Wizard: This is a step by step guide to protecting your system.

Change User MSG: for other users to view when attempting to log into The Lock.

View Log File: to view the last log file.  All attempts to enter a password are logged with the password that was tried, with the exception of the correct password.   In addition to the password attempts being logged, most every other entry item concerning The Lock is logged also.  (This includes password changes, messages viewed, log file viewed, etc.)

Back to previous.

                                   .


Virtual Programs Folder Example

Items are located in the left window and dragged to the right window.

Back to previous.

                                   .


Allowed Programs

Upon login, the user will be presented with a window that will reside on the desktop and is used to store shortcuts to programs that the user should be able to access.   These programs are the only programs that the user may run.

Allowed Program Configuration.

While in Admin mode, the system administrator may copy links from the different programs and items on the machine that the user will need to the allowed programs window.   This function is achieved by pressing the browse button, which will start Explorer.  From Explorer,  browse to the files and programs that the user should be able to use, and drag them into the available programs window.  Press the refresh button to refresh the data.

Once all the shortcuts are added to the available programs window, drag the individual icons to the allowed programs window for all those programs and files that the user should have access to at that level.

Right Click for popup menu.

Allowed Window Configuration.

This window contains the Window Class and the Window Title in the format WinClass : WinTitle.  This list indicates the group of files that The Lock will allow to run on the system.  When the Allowed Programs option is activated, any file that is executed, but not in the Allowed Windows list, will be terminated.  Use this option with care, as it will close any file not in the list.

Use the Allowed Window Configuration to grant some users access to programs that may reside out-side of the Allowed Programs window.  To do this, place the a link to the file on the desktop, or in a folder that the user may access.  Start the program.  Once it is running, press the capture button; the information for that program is now added to the Allowed Window Configuration.

Back to previous.

                                   .


Locked Files

All files in this list are automatically locked when a user of this level logs in.

Note:  While this lists length is limited by physical memory, each file listed is locked using its own file hande, one at a time.  Larger file lists will take longer lengths of time to lock.  Once locked, access to the file by any other application is denied.

Back to previous.

                                   .