The Lock
Comprehensive Windows 95/98/ME Workstation Protection

©1996-2001 CrashCourse Software
All Rights Reserved

Quick Start

General Information

Program Description:

The Lock provides comprehensive password protection for the Microsoft Windows 95 platform.  It can be configured to handle multiple user logins, as well as ninety levels of  restricted access to the machine.  The Lock now has the ability to validate a user's password locally, through a Novell Network Server, or via a dedicated Windows 95 or Windows NT validation system.  (A Windows 95 and/or Windows NT validation system requires the CrashCourse Network Validator, a freeware utility from CrashCourse Software).

Contact Information:

Contacting CrashCourse Software electronically:
Email: 	support@crashcoursesoftware.com
WWW:  	http://www.crashcoursesoftware.com

Telephone
Office: 	405-715-9998

Mailing Address
CrashCourse Software
PO Box 54321
Oklahoma City, OK 73154-0321

Other CrashCourse Programs

Boot Drive Lock, The Lock for Windows 3.1, The Synchronizer
Check out http://www.crashcoursesoftware.com/software.htm for the latest in shareware and freeware!
Special Thanks

CrashCourse software would like to thank the following individuals for their suggestions, comments, and input:

Mike Cremin
Biff Stephens
Brad Buxton
Joel Swift
Chris Lenderman
Richard Kent
Michael Callahan
Pino Calzo

Quick Start

Place the CD into your CD-ROM drive.  Installation of the software should begin automatically.  If it does not, press the Windows Start Button, select run and type D:\LOADER.EXE and press OK.  Make sure D: is your CD ROM drive, change to the correct letter if it is not.

Installation is broken into four parts:

1.  Installation.

During installation, the program files for The Lock will be copied to your hard disk.  Once all the files have been copied, you will be prompted to create an emergency boot disk as well as an emergency key disk.  The emergency boot disk can be used to boot the system from the A: drive to a DOS prompt and do an emergency removal of The Lock.  The emergency key disk can be used to access the system in Administrator mode when the Administrator password has been forgotten.

Once installation completes, you will be prompted to run The Lock.

2.  Setting user and the Administrator  passwords.  

The first password to be set is the standard USER password.  There will be a dialog box containing the user name obtained from the system.  Select a password for this user name and press Done to continue.   This password will log the user into the system at a general user level, but they will not have administrator access.

The second password is the administrator’s password.  Since this is the initial install, the default password of PassWordCrash will be automatically entered into the Old password box.  Select a new Admin password and enter it into the New password dialog entry.  Verify the password and press the Set Password button to continue.  DO NOT FORGET THIS PASSWORD, THERE IS NO "BACK DOOR" BUILT INTO THE LOCK.

3.   Configuring The Lock with the security Wizard.

After the initial passwords have been set, The Lock will prompt you to run the Configuration Wizard.  Selecting yes will run The Lock’s Configuration Utility and automatically start the configuration wizard.  This wizard can be used to configure all of the various security and options settings within The Lock.  Each setting is shown with a short description of what the option does.  Complete the desired settings on each page and press the Next button to continue.  When all settings have been selected, click Finish to return to the Configuration Utility.  Click Exit and The Lock will run.

4.   Securing the bootup process.

The system should be configured to not allow booting from the A: Drive by default.  This way a user cannot boot the system to the A: prompt and attempt to modify any startup files or remove The Lock.

Modifying the boot order in CMOS is the most common way to achieve this solution.

When the system restarts, it will usually display a message such as "Press DEL to enter CMOS" or "Press F2 for SETUP".  Once in CMOS, (BIOS), you will want to disable booting from the A: drive, and set a password up for access to the system setup.  MAKE SURE YOU CONSULT YOUR SYSTEM USERS MANUAL BEFORE MAKING ANY CHANGES TO YOU CMOS.  THE CMOS SETTINGS CONTROL ALL THE SYSTEM FUNCTIONS AND AN INCORRECT SETTING MAY CAUSE THE SYSTEM TO FAIL TO BOOT.

The most secure way, of course, is to install The Boot Drive Lock (http://www.crashcoursesoftware.com/bdlock.htm) as this will block the user from access the C: drive from an A: drive DOS prompt regardless of what the CMOS settings are.

How Do I…

…Set up my machine so only I have access?

Start The Lock.
Right Click on the Lock Icon in the task bar.
Select Options, then Configuration from the menu.
Press the Administrator button to log into Administrator mode.

The Lock Configuration Utility
Select the Configuratoin tab.  
Make sure Enable Demo Mode is not checked.
Select the Profiles tab.  
Un-Check Allow Multiple Users.
Check Enable Basic Login mode.
	Set Basic Login Lock password.

Unless another user knows your password, you are the only person with access to the system. 

…Set up my machine so that <someone> only has limited access?

Start The Lock.
Right Click on the Lock Icon in the task bar.
Select Options, then Configuration from the menu.
Press the Administrator button to log into Administrator mode.

The Lock Configuration Utility
Select the Configuration tab.  
Make sure Enable Demo Mode is not checked.
Select the Profiles tab.  
Check Allow Multiple User ID’s.
Check Activate User Level Profiles..
Click the User Level Profile Edit button.

The Lock User Profile Utility:
Select Restriction Information tab.
Click the Import Profiles button.
Select EXAMPLE.UPF from the Open Dialog Window, Click OK.

Select the User/Level tab.
This tab shows the current users for this level (in this case there is one user, user0).  It allows you to add users, remove users, set user passwords and set various options for this user level.

Note: various other .UPF files are included for example use.  Each user name and password in each .UPF file may be altered to best so your security needs.

How Do I… - Continued

In our example, the default user level, user level 10, is heavily restricted by the following:
Lock Start Menu (user may not access the Win95 Start menu)
Lock config files (Config.sys, Autoexec.bat and various other setup files are not accessible)
Hide Desktop (the desktop icons are hidden in this user level)
Hide System Tray (the system tray is not accessible)
Activate restricted programs options (explained below)
Activate allowed programs options  (Explained below)
Limited User Time (users at level 10 only has 10 minutes to use the system)

Select the Allowed Program’s tab. (one method of program restriction)
This tab shows the program items that will be allowed to run at this user level.
The items in the Allowed Windows list, are the only programs that the user is allowed to be running when the system is unlocked ( the user logs in).
When you press the Browse button, an explorer window will open up.  Browse to the programs you would like the user to access.  Example:

Press the Browse button, and browse to the Windows directory, drag CALC.EXE to the Available programs Window.  There is now a CALC added to the Available Windows list.  Select CALC and click it once to edit the name.  Change it to MS Calculator and press enter.  Drag it to the Allowed Programs window.  Now users with Level 10 access will be able to view info.txt and run MS Calculator.

Note:  This profile is configured for users 0 through 5.  Remove all the users and add your single user to the level of your choice, set their initial password, and configure their various security settings.

… Set up my machine so that <multiple users> have limited access?

This procedure is the same as setting the configuration for a single user with limited access.  Simply add the other users to the user list at their various security levels.

… Set up my machine so that all workstations use the same profile?

Configure the security profiles as listed above.  Select the User/Level page, press the Save button in the Network Profile section.  Select a location on the network that all connected workstations may access.  Share this resource as read only for all workstations except the administrators.  On all workstation systems, open the Level Information page of The Lock User Profile Utility.  Uncheck the Lock Profile Data File.  Check the User Level Profile is stored on the Network and click the Open button to browse to the data file.

…Verify passwords using pre-existing Novell accounts?

Start The Lock.  Right Click on the Lock Icon in the task bar.
Select Options, then Configuration Utility from the menu.
Press the Administrator button to log into Administrator mode.

The Lock Configuration Utility
Select the Login Tab.  
Check the Use Novell Password Validation option.

Note: Use of this option requires either the Netware driver NWCALLS.DLL to be in the Windows\System directory.  The Lock also supports the use of Novell’s Netware Client 32 for connection to Netware 4.x servers using NDS or Bindery.

How Do I… - Continued

…Set user profile levels according to Novell Netware Group membership?

Start The Lock. 
Right Click on the Lock Icon in the task bar.
Select Options, then Configuration from the menu.
Press the Administrator button to log into Administrator mode.

The Lock Configuration Utility
Select the Profiles Tab.
Press the Edit Profiles button.

The Lock User profile Utility.
Select the User/Level tab.

Set the Profile Level Name to any Netware group that is valid on the server. There is no need to configure individual user names.
When a user who is a member of the Netware group logs in, they will be set to the level configured with the Netware group
name. The Profile database is read from level 10 to level 99, the users level is selected as the first level containing a valid
Netware group name and the user is a member of that group.

Bindery Notes:  Under a bindery login, only those groups configured off the organization are valid.  Each user must be configured as a trustee to their group with at least read access to the object.

NDS Notes:  Under an NDS login, any group the user is a member of may be used.  The Group name used in The Locks User Profile must be the entire NDS name of the group.  Ex:  Group is LockUser1, Container is GeneralUsers, Organization is CrashCourse.  The correct Lock Profile Group name would be: LockUser1.GeneralUsers.CrashCourse.

Note: Use of this option requires the Netware driver NWCALLS.DLL to be in the Windows\System directory. The Lock also supports the use of Novell’s Netware Client 32 for connection to Netware 4.x servers using NDS or Bindery.

…Verify passwords using pre-existing Windows NT domain accounts?

Start The Lock.
Right Click on the Lock Icon in the task bar.
Select Options, then Configuration from the menu.
Press the Administrator button to log into Administrator mode.

The Lock Configuration Utility
Select the Login Tab.
Check the Windows NT Validation option.
Set the WinNT Login Domain to the desired login domain server.
Set the WinNT Server Name to the desired login server name.

Note: Use of this option requires the system be configured for User Level access control.

How Do I… - Continued

…Restrict access to certain programs?

Start The Lock.
Right Click on the Lock Icon in the task bar.
Select Options, then Configuration from the menu.
Press the Administrator button to log into Administrator mode.

The Lock Configuration Utility
Select the Profile tab.
Click the Edit Profiles button.

Select a security level to modify.

Select the Restricted Programs tab. (one method of program restriction)
This tab shows a list of windows that are restricted by Window Class, Window Title or both.  Any time a user opens a program, The Lock checks this list to see if the program is allowed.  If it is not allowed, The Lock will close the window automatically.

…Allow users only during certain times?

Start The Lock.
Right Click on the Lock Icon in the task bar.
Select Options, then Configuration from the menu.
Press the Administrator button to log into Administrator mode.

The Lock Configuration Utility
Select the Profile tab.
Click the Edit Profiles button.

Select a security level to modify.

Select the Restriction Information tab.
Press the Activate time restrictions button to select valid login times and days for the current security level.

…Set up temporary passwords?

Right Click on the Lock Icon in the task bar.
Select Options, then Configuration from the menu.
Press the Administrator button to log into Administrator mode.

The Lock Configuration Utility
Select the Profiles tab.
Click the Edit Profiles button.

Select a security level to modify.

Select the Restriction Information tab.
Configure the Max number of logins allowed for this security level.

Select the Users/Level tab.
Add a temp user name to this security level and set the temp user’s Password.

Each time a user logs in at this level, the remaining logins are reduced by one.  When the remaining logins reaches zero, that temp user will not be permitted any more logins.  

NOTE:  This option is not available when the User Profile Database is stored on a Network drive.

How Do I… - Continued

…See who’s been logging into my machine when I’m away?

Start The Lock.
Right Click on the Lock Icon in the task bar.
Select Options, then Administrate  from the menu.
login in Administrator mode.

Open the Configuration Utility.
Select the Misc tab, click the View Log button

The log file is divided into groups, listed by username.

…Prevent someone from booting to DOS?

Right Click on the Lock Icon in the task bar.
Select Options, then Configuration from the menu.
Press the Administrator button to log into Administrator mode.

The Lock Configuration Utility
Select the Start Up tab.

Check Enabled DOS startup protection
Check Use The Lock for DOS

Now, when the system is re-started, or the system is shut down, The Lock for DOS will be activated automatically

…Safeguard my Windows 3.1 configuration?

Get The Lock for Windows 3.1

Troubleshooting

Frequently Asked Questions:

Q. 	How do I change my Administrator password.
A. 	There are three methods of altering the administrator password.  
1.	Log into The Lock using the existing administrator password, right click on the pad lock icon in the system tray, next to the clock, select Security from the menu then select Change Password.  
2.	Log into The Lock using the Admin password, right click on the pad lock icon in the system tray, select Options from the menu, then Administrate.  Select Change Admin Password from the menu.
3.	Open The Lock Configuration Utility, select the Profile tab, click the Password button under the Master Administration box.

Q. 	I am locked out of my system. It is asking for the Administrator Password, I did not set an Administrator password.
A. 	The Default administrator password is PassWordCrash.  This password is case sensitive; make sure you type it correctly with a Capital P, W and C.  After you have logged in, you should change the Administrator password to something else.

Q. 	How do I un-install The Lock?.
A. 	If you have a new version (Version 97k or greater), simply select Control Panel from the Settings option on the Start Menu. Then select  Add/Remove Programs, click on The Lock Uninstall and press Add/Remove.

If you have a version previous to 97k, or your version of The Lock is simply The Lock 97, then follow these instructions:

There is a padlock-shaped icon near the clock on the system bar. Right click this icon. Select Options, then Lock Config. Login with the Administrator Password if so prompted.  On the first page (startup) is the load with Windows option. Make sure there is no check box here. There is an option that says Complete Protection (it may say System Monitor instead), make sure there is no check in this box either. Next select the DOS page. There are three options, make sure no options at all are checked. Then click OK button on the bottom of the form.

Now right-click on the pad lock shaped icon again, this time select File then Exit.

Now start Control Panel (Windows 95 Start Button- Settings) and double click Add/Remove Programs. Select The Lock Uninstall, and press Add/Remove. 

You may verify Uninstall by browsing to The Lock directory, it should be gone now. If The Lock was installed into the default directory, it would be at: C:\Program Files\CrashCourse\thelock you may browse to this directory in explorer. If it is gone, then Uninstall was successful, if it is not gone, then simply delete it.

Q. 	I am stuck at The Lock for DOS, what do I do?
A. 	The password to The Lock for DOS is the same as the Administrator password for The Lock Remember, it is case sensitive.

Q. 	I cannot seem to enable Novell validation.
A. 	Novell Validation requires the Netware file NWCALLS.DLL to be in the Windows System directory or Netware Client 32 to be installed for  validation. You must also be connected to a Novell Netware 3.1x or 4.1x server.

Q. 	The Lock does not validate from the Windows password.
A. 	In order for The Lock to validate the users Windows password from the local Windows 95 system, the user must be logged into the current session of Windows 95 and a network protocol, such as Microsoft Networking, must be installed and running.  No actual network connection needs to be active.

Contacting Technical Support

Please refer to the addresses listed on page 2 

Copyright 1996- 2000 
CrashCourse Software
All trade names mentioned are registered by their respective owners.