Quote:
|
All I asked you was to explain your points of how modifying the properties of a shortcut, in any way, restricts mobility, or replication, or a security concern. I really would like to know.
|
Sure. First tip, try not to break into a pissing contest about "my network is bigger than yours". This tends to discourage open discussion. If you can get beyond that, then sure, I'd like to learn more too.
I'm currently contracted with JPMorganChase doing network support and the like. I've done similar work with other large scale networks. That said I cannot reveal certain features they use. My suggestion was to assist folks that might be deploying to desktops on a large scale to foment better security and reduce costs through the end of life-cycle. It's openly available via my link above, and not intended for individual user use in a general sense, which is why I suggested it.
As for the shortcuts, if you shortcut or create a link to a locally stored executable and that executable changes name or location, that link becomes useless. Multiply that by 100, 000 and you've got a bigger problem. In addition, that link only runs the app...it doesn't check the server for the 'latest and greatest'. This doesn't account for remote users but they are usually a smaller number and can be accomodated differently, depending on your setup.
All that aside, from a user perspective, asking them to remember numerous shortcuts to run apps is counter-productive and costly if considered from a life-cycle view, especially on a large scale. This is especially crucial if the key security counter-measure for Windows is the ctrl-alt-del function which is a de facto standard to thwart intercepts, loggers, and the like. Anything similar to that, as in your example, is probably ill-advised and confusing.
So, assuming your setup were to remove the command prompt and the run command from the start menu as part of its applied policy to every workstation, you'd wan't a similar, although less known but convenient way of accessing the command prompt. Your policies would still restrict user intervention, yet provide a way for local support to quickly gain that lovely C:>. It works well from my experience but every network is different.