The Lock 98:
Comprehensive Windows 95 Workstation Protection

©1996-1997 CrashCourse Software
All Rights Reserved

Users Guide

Notices:

This program is Shareware. If you like this program please  send your REG ID (from the registration page of Help/About) , Email address,  registration fee, and any comments to:

CrashCourse Software
attn: Rob Boulden
1007 South Lewis
Stillwater, OK 74074

Fees:

Single User License:
Software downloaded from Internet:			$25.00US
Software mailed on floppy disks:			$35.00US
Software mailed on floppy disks with DOCS:	$40.00US

Multiple User License:				Email for details
Modified/Specialized versions of The Lock:		Email for details

WWW:  	http://www.theknow.com/CrashCourse
FTP:  		ftp://ftp.theknow.com
Email: 		CrashCourse@theknow.com
Support: 	CrashCourse@theknow.com

Usage:
The Lock provides comprehensive password protection for the Windows 95 platform.  It can be setup to handle multiple user logins, as well as setup nine levels of  restricted access to the Windows 95 machine.  The Lock now has the ability to validate a users password locally,  through a Novell Network Server, a dedicated Windows 95 validation system, or a Windows NT.  (Windows 95 validation system and Windows NT require the CrashCourse Network Validator, a freeware utility from CrashCourse Software).

All menu items are accessed through a pop up menu.  To access this menu, click on The Lock's icon in the system tray.

Copyright 1996, 1997 
CrashCourse Software
All trade names mentioned are registered by their respective owners.

Menu Options: (accessed through icon right click or panel menu)

File options.
Start Lock to activate The Lock Password Protection.  This mode is the standard protection for The Lock.  In this mode, the user may enter their user name (if multiple users are enabled in The Lock config window) and password.  If the correct password is entered, the system is then unlocked. 
Exit this menu item will close The Lock.  If the lock is not in Admin Mode, the current user will be may asked for the Admin password to exit the lock or close windows.

Password options.
User Password to change the Lock Password. This is the standard user login password.  It will be linked to the current Windows 95 user name if the system is in single user mode.  Activating Multi user will allow multiple users to run The Lock on the same machine.  (Each user must have their account activated by the Admin user if local password validation is being used, or they should use Novell validation, or The CrashCourse Network Validator.)

Options menu.

The Lock Config Dialog

User Options: 

User Options:
Start Windows Screensaver on Lock: Select this item to use the Windows Screen Saver, if one is installed.
Blank Screen on Lock: Select this item to blank the screen each time the system is locked.

Show Sys Mon Panel: View the current status of The Lock, including protection level.
Show  Sys Mon Menu: Show The Locks Menu in the Panel window.
Reset Panel: This will set the panel's display position to the upper left of the display.

PassWord Dialog Auto hide: Use this option to hide the password dialog box after the determined amount of time, until the user move the mouse or types a key. 
Lock after Idle Time: To automatically lock the system after it has remained idle for a certain length of time.  Use edit box to adjust max idle time.

Admin Options:( Login using Admin Password or select Admin button on Options page)
All items listed below also include the items listed for User Options.

Start Tab:
Load The Lock with Windows: To automatically load The Lock upon Windows startup.
Auto Lock when started:  To activate The Lock password entry automatically upon program startup.

Enable Demo Mode:  This will remove most of the protection processes used The Lock.  This mode is only good for initial demonstration and customization of The Lock.  It will give new users the ability to play with The Lock and not lock them selves out of the system.

Show Help on Password Login: This option will display a help button on the main login screen.  This is useful for new and initial users.  It is recommended that this option be disabled after Lock configuration is complete.
Show Cancel button on Admin Login: This option is will add a cancel button when the Admin Password dialog is started.  This is useful on systems where the user may have a tendency to start the Admin Password dialog by accident.  If this is enabled, the user may cancel out of the dialog.  If it is not enabled, the Admin will have to type the Admin Password to close the dialog.

Enable Log File: This option will enable or disable The Lock's log file.  When the log file size grows to be greater than 64k, the file is automatically copied to The Lock’s install directory.  The file name is the current date and a .log extension.
Don't show hidden files on startup: This option will allow Windows 95 to automatically switch to hidding hidden and system files upon bootup.  In addition to hiding these files, it is a good idea to use the System Monitor and capture the options window used to change between hiding and showing hidden files.  (Click on My Computer, select View, then Options.  Pick View page.  The first selections will switch between hiding and showing hidden files. 
Use The Lock's Splash-screen on bootup: Use this check box to enable or disable The Lock's splash-screen upon program startup.

Login Tab:
Novell Validation:  Will allow The Lock to validate user passwords through a Novell network.  (this feature requires NWCALLS.DLL to be in the Windows System directory, or Client 32 to be installed on the system.
Use CrashCourse Net Val: This will allow validation of the users password through the CrashCourse Network Validation utility (a freeware separate utility).     This utility can validate against a user name/password database, or a Windows NT server.
Windows NT Login Domain:  This is the domain used for Windows NT login validation.  It is usually set by the system, but may be edited to the correct Windows NT domain.

Allow Multiple Users: Select this option to allow multiple users to log into The Lock with their own user names.  If the system is not configured for Novell Validate or CrashCourse Net Val, each user must have their account set up locally.
User must log in locally: This option will force the user to log into Windows 95.  Pressing Cancel on the Windows login screen will cause the user to be logged off, then back on again.
System user logs in as Admin:  This option will allow The Lock to enter Admin mode (user name will have Admin Mode printed after it), allowing access to configuration settings, when the local user logs in.  The local user is the person who is logged into Windows 95 on that machine.  Any other user logins will be in normal user level mode.  This option is not recommended for multiple user systems.

Validation Timeout:  Validation timeout is the amount of time The Lock will wait for a response from the validation server before it switches The Lock to local validation mode.

DOS Tab:
Use The Lock for DOS: This option will protect the system bootup while CONFIG.SYS and AUTOEXEC.BAT are being processed.  The Lock for DOS uses the Admin password.  This feature is not recommended unless the system has a multiple boot configuration and can boot directly to DOS.    
The Lock for DOS: Admin Only:  If this option is checked, the admin password is the only password that will be accepted in The Lock for DOS.
Allow DOS Lock timeout:  If The Lock for DOS is used, it will time out, and continue to boot after 10 minutes.  If this item is unchecked, The Lock for DOS will not time out.
Protect ScanDisk for DOS: Some later versions of Windows 95 (OSR2 in particular)  have a new safety feature added.  This feature will allow Win95 to run SCANDISK.EXE when the system detects that it was not shut down properly.  This event presents a security risk because the system user may press CTRL-BREAK to stop the process and exit to the DOS prompt.  They could then delete The Lock and any protection it offers.  
Lock Out DOS Boot Keys: This option will disable the DOS boot keys. (F5 and F8, etc.);
Lock Out Win95 Boot Keys: This option will disable the Windows 95 boot up keys (shift f5, shift f8, f5, f8, etc);

Admin Tab:
Use Quick Batch After: This option will automatically execute the programs listed in the files to execute drop down box after a number of fail attempts.  
WARNING:   Use  this feature with great care.  The Lock 97 will execute any Windows or DOS program that is entered into the list box, including DOS BATCH (.bat) files.  No warning window is presented, and the programs may be run in hidden mode thereby not alerting the user to their operation.
Files to execute: This dropdown box contains the list of file that will be executed upon a predetermined number of login attempts.  If the dropdown box is blank, the button to the right will read Add File.  If the dropdown box contains a file name, the button to the right will read Del File.  Any file (DOS [exe, bat, or com] or Windows [exe]) may be added to the list up to a total of 5.
Run Hidden: This option will execute the files in hidden mode.  Their icons will not display on the system bar and they will not show up in the task switcher.

Admin Lock after: This option will automatically put the system in Admin mode after a failed number of attempts.  This mode will require the Administrator password before the system can be unlocked.

Use Logon Greeting: Use this option to print a message to the users that successfully logon to the system.  The imbedded codes are:
%u:	Current User logged into The Lock.
%a:	Administrators user name.
%d:	Current Date.

Use Simple Lock: This option will active The Lock protection in Simple Lock Mode.
Profiles Tab:
Default Login User Name:  This is the default user name that The Lock will use when no user name can be resolved by the system.
Use user level profiles: This option must be selected to enable User Level profiles.

Show Close Window Message:  This option will allow a message to show when the user opens a window that is closed by the Monitor.
Sys Mon Interval:  This slider setting will determine how often The System Monitor will check for windows that are listed in the file limitation data and need to be closed.    The higher the setting, the less system resources are used, but some windows may take up to one second before they are closed.

Hot Keys:
Lock Hotkey:  Start The Lock Protection in Standard Mode using a hotkey. 
Admin Lock Hotkey:  Start The Lock Protection in Admin Mode using a hotkey. 
Config Lock Hotkey:  Start The Lock's Configuration Utility using a hotkey. 
Exit Lock Hotkey:  Close The Lock using a hotkey. 

Profiles Page (Configure User Security Levels, by pressing the Profiles button)

Profiles Tab:
Lock Start Menu:  This feature will automatically interrupt the use of the Start Menu.
Lock Config Files:   This option will lock the key system configuration files.   These files may not be altered while they are locked.  Such files include CONFIG.SYS, AUTOEXEC.BAT, MSDOS.SYS and any Lock configuration files.
Hide Desktop:  This feature will hide the task-bar and the desktop icons when the user logs in.

Allow Windows Shutdown Only:   When a user logs in, and their profile has this option checked, they will be presented with the Windows shutdown screen.  Use this option will all the other limitation options, and the logged in user will only be able to shutdown the system.
Admin Lock Before Windows Shutdown:   If this option is checked, the Admin password is required to restart Windows 95.  If this option is not checked, the system may be shutdown, restarted, or have a new user login, but the Admin password is required to restart in MSDOS mode.

DisAllow Files: Use the Disallow files configuration.
Allow Files: Use the allowed files configuration.

Limited User  Time: Change the amount of time that Sentry Security will be active before re-locking the system.

Max Logins Allowed: Total number of times the current user level may log into the system.
Logins Remaining: Total number of remaining logins for the current user level.

Login Between: Use this option to specify the time-period that a user may be logged into the system.  The time is displayed as Login Time - Logout Time (HHMM-HHMM).  The time specified is military time.  Example:  8:00AM to 5:00PM is the allowed login time for the current user level.  The time representation for this period would be 0800-1700.  If a user logs in before or after their allowed time, they are logged out.  If the user is logged in, and the time reaches their logout time, they will be presented with a 10minute timer, after which they will be logged out automatically.

Current User Level List :  Enter users for list profile level into this list.
Set Pass :  Press this button to set the password for the selected user.
Allow DOS Lock Pass :  Add any users that will be allowed to log into The Lock 97 for DOS (if this utility is being implemented on the system.)
User Security Profile Levels:  Select this option to specify a profile level for all the users.  Any users not listed in the Profile Level editor will automatically have the default security level.

DisAllowed Tab

Adding files to monitor.
Enter data on which windows to close for each security profile.

In the Classes edit blank, enter the class name of the Window to monitor.
A * may be entered to monitor all window classes for a specified title.

In the Current Title edit box, enter the name of the window to not allow operation.
A * may be entered to monitor all window titles, a * and part of the title will monitor any window with that part of the title in it.

Examples:

Open My Computer, browse to C:\Win95 (if Windows is in a different directory use that instead)
Open Lock Config, select Profile, select DisAllow page.  Click Capture button.  Click on the My Computer window.  The information from the My Computer window is now added to the Capture window.  

Click Done.

The followeing data is now entered into the Kill File list (item number one is what is entered, items 2, 3, and 4 are modifications made to change the results)

Class name:	 	Window Title	Close Action
CabinetWClass	 C:\Win95	Any window with class CabinetWClass and title 'C:\Win95'.
CabinetWClass	 *		Any window with class CabinetWClass and any title
CabinetWClass	 *win95	Any window with class CabinetWClass and win95 in the title.
*		 *win95	Any window with any class and win95 in the title.

Button Information:
Remove all:	Remove all window data.
Remove:	Remove current selected window data.

Add:		Add current window data. (Data is entered into the edit box);
Clear:		Clear current edit boxes.
Capture:	Launch the window capture utility.

Using the Window Capture utility.
Select Capture to activate the Window information capture utility.  While this utility is running, select any open window that the system should not allow to operate, then press any key.  The window title and window class will now be entered into the appropriate edit boxes.  Click OK and the items will be added to the monitor list, or click Cancel to ignore the information.

Allowed Tab:  

This option will present the user, upon login, with a window that will reside on the desktop and is used to store shortcuts to programs that the user should be able to access.   These programs are the only programs that the user may run.

Allowed Program Configuration.
While in Admin mode, the system administrator may copy links from the different programs and items on the machine that the user will need to the allowed programs window.   This function is achieved by pressing the browse button, which will start Explorer.  From Explorer,  browse to the files and programs that the user should be able to use, and drag them into the available programs window.  Press the refresh button to refresh the data.

Once all the shortcuts are added to the available programs window, drag the individual icons to the allowed programs window for all those programs and files that the user should have access to at that level.

Allowed Window Configuration.
This window contains the Window Class and the Window Title in the format WinClass : WinTitle.  This list indicates the group of files that The Lock will allow to run on the system.  When the Allowed Programs option is activated, any file that is executed, but not in the Allowed Windows list, will be terminated.  Use this option with care, as it will close any file not in the list.   

Use the Allowed Window Configuration to grant some users access to programs that may reside out-side of the Allowed Programs window.  To do this, place the a link to the file on the desktop, or in a folder that the user may access.  Start the program.  Once it is running, press the capture button; the information for that program is now added to the Allowed Window Configuration.  

Admin Tab:  
Complete user listin:  This list contains all the users names and their user level. (seperated by a : )

Admin Password: to change the Admin Password.  (Default is PassWordCrash and is case sensitive)
Write MSG: for other users to view when attempting to log into The Lock.
Start the Security Wizard: This is a step by step guide to protecting your system.
View Log File: to view the last log file.  All attempts to enter a password are logged with the password that was tried, with the exception of the correct password.   In addition to the password attempts being logged, most every other entry item concerning The Lock is logged also.  (This includes password changes, messages viewed, log file viewed, etc.)

Export Profile: save the profile database to a file for use on other systems running The Lock.
Import Profile: Load and use a profile database configured on another system running The Lock..

Misc Config:

Screen Saver Config: Configure the Windows 95 screen saver.
Win IP Config: Configure and view the Windows 95 IP configuration data..

Administrate:

Admin Lock System Used to lock the system requiring the Admin Password to unlock.

Admin Password: to change the Admin Password.  (Default is PassWordCrash and is case sensitive)
Write MSG: for other users to view when attempting to log into The Lock.
Start the Security Wizard: This is a step by step guide to protecting your system.
View Log File: to view the last log file.  All attempts to enter a password are logged with the password that was tried, with the exception of the correct password.   In addition to the password attempts being logged, most every other entry item concerning The Lock is logged also.  (This includes password changes, messages viewed, log file viewed, etc.)

Help to activate help file.
View Menu

View Message File to view the last message file.  Persons may leave a message to you while the 
lock is running by tabbing to the Leave MSG button and pressing enter, or by pressing ALT-L . 
The messages are dated and timed.  
While being viewed, the message base may be deleted.

User Info

View the current user name, system name, login domain, lock version and operating system.

Help Menu

About to view about information, version number, and registration information.

The Lock Notes

The Lock’s icon in the system tray will have a colored dot in the upper right hand corner:
Green: 	Admin logged in.
Yellow:	User logged in.
Red:	System Locked. 

The default Admin password is :PassWordCrash, it is case sensitive.
The Lock 97 may have its Admin password altered by selecting Passwords/Administrate from the pop up menu.  Once changed, only you will know the Admin password.  This will offer a second level of protection.   It is STRONGLY recommended that you change the Admin password from it's default of "PassWordCrash".    When the system is in total protection mode, the Admin password is required to change any major aspect of The Lock and to log out of the current session of The Lock.

Modes of Operation

The Simple Lock.

This is the basic Password locking mode.  In this mode, you may use the master password or the Admin password (make sure you customize it).  

The Lock.
This is the standard Password locking mode.  In this mode, you may use the master password, the Admin password (make sure you customize it) or the temp master password to unlock The Lock.   The temp Sentry passwords will exit The Lock, but leave the Sentry running.  If Multiple users are enabled in The Lock Options page, the user name may also be altered on this window to log into the workstation as a different Lock User.  If the system is configured for multiple users, the user name may be entered along with the password.

Note:  The temp passwords are good for a user defined limited number of accesses only.

User Profiles
When The Lock is configured for multiple user profiles, different users may have different security levels.  In this mode, the system will act in its normal fashion, however, The Lock's System Monitor will be active the entire time.  When in this mode, it will require the Admin password to alter any of The Lock's configuration items.  As users log in, their security profile will be determined by the Admin's profile list.  If the user does not appear on the profile list, the profile level will default to 10.  Depending on the specific user profile, and the allowed or disallowed programs, different options may or may not be available to the user.  

Such options would be the shut down options.  If the user shuts down the system, The Lock will show a prompt with a list of options for Windows shutdown.  Shutdown will not continue until the user makes a selection; this will offer a higher level of protection by not allowing The Lock to exit until Windows is about to close itself.     Locking the Start Menu will not allow the user to access any Start Menu items.  The amount of time a user may access the system may be specified as unlimited or any time between 10 and 90 minutes.  

While running in this mode, if a user closes The Lock by pressing CTRL-ALT-DEL and selecting Close Program The Lock will be restarted, and the system then locked.

Password Validation Configurations

Password Modes:

User Mode:
This is the standard Log in mode.  In this mode, with Sys Mon enabled, the logged in user may access normal settings, and programs, but are locked out of any programs or features designated by the Admin using profile levels and the file limitation utility. (Options page)

Admin Mode:
This is the administrator mode.  In this mode, the settings for The Lock may be altered, as well as passwords and other security options.  This mode may be entered by typing the Admin password at any password dialog box.  The machine may be configured to recognize the local user as the machines user.  When that user logs in, the system will automatically enter Admin mode.  This is enabled by selecting the "Local user login is Admin" option on the Lock Config /Startup page.  Ex.  If this is your machine, when you log in, it will enter Admin Mode automatically.  When password protection is started again, the system will revert to user mode.

User Modes:

Single User is Administrator.
In this mode, the system user would install The Lock, and configure the Admin password and settings, and User password as they would find most fit.  (System Monitor Mode will offer highest degree of protection).   This option is best to keep relatives or room mates out of your system.

Single User is NOT Administrator.
In this mode, the Administrator would install The Lock, and configure the Admin Password and any necessary Admin Settings.  They would then configure the initial user and password.  Upon completion of this task, The Administrator would put the system into System Monitor Mode.  The Administrator could then configure any Window Classes or Window Title that should not be allowed to run on the machine.  The user would then login to the system using the initial user password supplied by the Administrator.  The user would then customize their password.  This is best to allow specific usage of a machine by the single user for each machine, while offering complete usage to the administrator.

Multiple User Systems.
In this mode, the Administrator would install The Lock, and configure the Admin Password and any necessary Admin Settings on a single machine.  Each machine would be configured to use Multiple Users.  The Admin would then configure the initial user and password for each machine, for each user.  Upon completion of this task, The Administrator would put the system into System Monitor Mode.  The Administrator could then configure any Window Classes or Window Title that should not be allowed to run on the machine.  The user would then login to the system using the initial user password supplied by the Administrator.  The user would then customize their password.  This is best to allow specific usage of a machine by  multiple users, while offering complete usage to the administrator.

In each of the above cases, the password  is validated on the local system.

Network Modes:

Systems with Novell.
On systems running Novell Netware 3.x or greater, the Admin will configure the system in one of the configurations listed above.  They would then add the file NWCALLS.DLL to the Windows System Directory.  Within The Lock Options, on the Login page, the Admin would check the Use Novell Validation checkbox.  If this option is not enabled, it is because NWCALLS.DLL is not in the Windows System directory.  Once this is completed.  The machines will then validate the user against their Novell Netware Account.

Systems with the CrashCourse Network Validator.
On systems running in any sized Microsoft Network, using pier to pier networking, the Admin will configure the system in one of the configurations listed above.  They would then configure one of the systems (usually the Admin's system) to be the Network Validator.  On this machine, they would run the CrashCourse Network Validator utility (CC Net Val).  Before configuring any workstation, the Admin would add each user with their initial password to the CC Net Val utility.  Within The Lock Options, on the Login page, the Admin would check the Use CrashCourse Net Val checkbox.  If this option is not enabled, it is because CCNETVAL is not running on the designated machine, or the resource CCNETVAL\ROOT is not being shared.  Once this is completed, and all users have been entered.  The workstations will then validate the users password against CCNETVAL utility.  As each user changes their user password, it is changed on the CCNETVAL machine, not the local machine, so the CCNETVAL\ROOT shared resource must be shared with read/write access.  The CCNETVAL utility may also be used on a Windows NT server.  In this situation, it is installed and setup as above, but Windows NT is selected as the validating device.

Frequently Asked Questions:

Q. I am locked out of my system. It is asking for the Admin Password, and the word (PassWordCrash) is visible, but nothing I type does anything.
A. The word appearing on the screen in brackets is your current default Admin Password. This password is case sensitive. Make sure you type it correctly with a Capital P, W and C.

Q. How do I un-install The Lock 97.
A. If you have a new version (Version 97k or greater), simply select Control Panel from the Settings option on the Start Menu. Then select  Add/Remove Programs, click on The Lock 97 Uninstall and press Add/Remove.

If you have a version previous to 97k, or your version of The Lock is simply The Lock 97, then follow these instructions:

There is an icon, near clock, on the system bar, it is shaped like a pad lock. Right click this icon. Select Options, then Lock Config, it may ask you for the Admin Password. If it does, then type in your Admin Password. On the first page (startup) is the load with Windows option. Make sure there is no check box here. There is an option that says Complete Protection (it may say System Monitor instead), make sure there is no check in this box either. Next select the DOS page. There are three options, make sure no options at all are checked. Then click OK button on the bottom of the form.

Now right-click on the pad lock shaped icon again, this time select File then Exit.

Now start Control Panel (Windows 95 Start Button- Settings) and double click Add/Remove Programs. Select The Lock 97 Uninstall, and press Add/Remove. 

You may verify Uninstall by browsing to The Lock 97's directory, it should be gone now. If The Lock 97 was installed into the default directory, it would be at: C:\Program Files\CrashCourse\thelock you may browse to this directory in explorer. If it is gone, then Uninstall was successful, if it is not gone, then simply delete it.

Q. I am stuck at The Lock for DOS, what do I do?
A. The password to The Lock for DOS is the same as the Admin password for The Lock 97. Remember, it is case sensitive.

Q. I cannot seem to enabled Novell validation.
A. Novell Validation requires the Netware DLL NWCALLS.DLL to be in the Windows System directory for Novell validation. You must also be connected to a Novell server.

Q. I have entered Window information in the Sentry Monitor Files list. I then tried to remove them, but they wont go away.
A. Upgrade to The Lock 97r3 or later from the CrashCourse Web Page.

General Security Issues:

The following nine security items must be addressed in order to ensure maximum security for the system.

1.  Physically secure the computer:  Use a locking case, or a locked closet. 
2.  Protect CMOS with a password.
3.  Disable booting from the A: drive.
4.  Boot directly into Windows 95.  If multiple configurations are needed, use The Lock for DOS to protect the boot process.
5.  Auto load The Lock with Windows.  Auto lock when The Lock is loaded.
6.  Be aware of any network connections to the machine.  Only share those resources that are needed by outside users.
7.  Always use the System Monitor Mode of The Lock.
8.  Always use the idle detection timer to automatically lock the system.
9.  Never leave the machine un-attended without locking it first.

Uninstall

Exit The Lock:
Start Control Panel (Start button / settings / Control Panel)
Double click Add/Remove Programs.
From the list choose The Lock 97 Uninstall
Press Add/Remove

Example Profiles

Configure The Lock to use Multiple User Profiles by following the following example:

Start The Lock.
Right Click on the Lock Icon in the task bar.
Select Options, then Lock Config from the menu.
Press the Admin button to login in Admin mode.

Lock Config:

Select the Startup tab.  
Make sure Enable Demo Mode is not checked.

Select the Login tab.  
Check Allow Multiple Users.
Make sure Use Novell Password Validation and Use CrashCourse Net Validation are not checked.

Select Administration tab.
Make sure Use Basic Lock is un-checked.

Select User Profiles  tab.
Make sure Use User Level Profiles is checked.
Set SysMon Validation Interval  to minimum time setting.
Click Edit Profiles Button.

User Profile Utility:

Select Admin tab.
Click Import Profiles button.
Select EXAMPLE.UPF from the Open Dialog Window, Click OK button.

The lock has just loaded a five user profile.  The user names are user0 - user5, their passwords are password0 - password5 respectively.  Their user leves are from 10 - 15 respectively.  If you log in as user0, your password would be password0, and your user level would be 10 (10 is also the default user level).

Click on user0 in the profile list (the user name is followed by their user level).

Select the Profiles tab.
This tab shows the current users for this level (in this case there is one user, user0).  It allows you to add users, remove users, set user passwords and set various options for this user level.

In our example, the  user level 10 is heavily restricted by the following:
Lock Start Menu (user may not access the Win95 Start menu)
Lock Config Files (Config.sys, Autoexec.bat and various other setup files are not accessable)
Hide Desktop (the desktop icons are hidden in this user level)
Hide System Tray (the system tray is not accessable)

DisAllow Files (explained below)
Allow Files (Explained below)

Limited User Time (users at level 10 only has 10 minutes to use the system)

Select the Allowed tab. (one method of program restriction)
This tab shows the program items that will be allowed to run at this user level.
The items in the Allowed Windows list, are the only programs that the user is allowed to be running when the system is unlocked ( the user logs in).
The items in the Available programs window are the programs that are available for all the users (the Allowed Programs window is the list that is available for this user level only).
When you press the Browse button, an explorer window will open up.  Browse to the programs you would like the user to access.  Example:

Press the Browse button, and browse to the Windows directory, drag CALC.EXE to the Available programs Window.  There is now a CALC added to the Available Windows list.  Select CALC and click it once to edit the name.  Change it to MS Calculator and press enter.  Drag it to the Allowed Programs window.  Now users with Level 10 access will be able to view info.txt and run MS Calculator.

Select the DisAllowed tab. (another method of program restriction)
This tab shows the programs that are not going to be allowed to run.
The items on the left are the Window Class and the items on the right are the Window Title.  These two items tell The Lock what windows to allow and what windows to not allow.

In our example at Level 10, the following is known by The Lock.
If you open a window with class #32770 (standard Windows Dialog class) and the title has the word Options, prop or run in it, the window will be closed. (the title is not case sensitive, so RUN is the same as run).  
Further, any window of class CabinetWClass with title * (meaning any title at all) will be closed.  This class is actually the class for the My Computer and Network Neighborhood icons.  They will be closed upon starting to browse.  
The same is true for the ExplorWClass (Explorer.exe windows) and SYMCP4_FileMgr (Northons File Manager)

Now, we are going to add a window to the DisAllowed List.
Click Win95's Start button, select Programs, Accessories and click on the Calculator icon.
Calculator is now started.
Next, click on the Capture button on the DisAllowed page of the User Profile Utility.
Click on the Calculator Window, then move the cursor over The Lock's Capture window.
The information for Calculator is now added to the Capture window.  Press the Add Button, then the Done button., now the info is added to the DisAllowed Windows list.

Click Apply then click OK on the User Profile Utility.

Click OK on the Lock Config dialog.

Next follow these instructions. (read them all before doing them)
Double Click The Lock icon in the system tray.
Select the User Name edit box, enter user0
Type password0 as the password.

You will be presented with a window containing Item.txt and MS Calculator.
Double Click Item.txt, and Notepad is opened with the text.  Close it.
Double Click MS Calculator, it is opened then closed. (if it is not closed, make sure you un-checked the Use Demo Mode checkbox of the Startup Page in  Lock Config.)

Select Exit from the menu to logout.

Enter your user name and your Admin Password to access the Lock Config as before.

Next try user1, user2 etc to get a feel for the different options and different restrictions available.

Special Thanks

CrashCourse software would like to thank the following individuals for their suggestions, comments, and input:

Mike Cremin
Biff Stephens
Brad Buxton
Joel Swift
Chris Lenderman
Richard Kent
Michael Callahan