<h3 align="center">WINDOWS 9x/ME SECURITY AND SYSTEM RESTRICTIONS</h3>

<p align="center">Version: 1.0b<br>

Written by: <a href="mailto:jacorex@hotmail.com">PHaRaoH</a><br>

for the <a href="http://blacksun.box.sk">Blacksun Research Facility</a>.<br>

Release Date: 20 January 2002</p>

<hr align="center" noshade width="90%">



<p>[DISCLAIMER]</p>

<p>This tutorial was written for informational purposes only, so let's keep it that way!<br>

I am not responsible for anything stupid you do with this information (not that you can do 

anyting stupid with it but you know people...). yada yada yada...</p>



<p>[THE FLASHING RED WARNING NOTE]</p>

<p>This tutorial is about editing the registry. Editing the registry is very dangerous: 

you can break your PC, so please take the time and backup the registry before you even try

anything written in this tutorial. I also suggest that you first read the other tutorials about 

the registry available from BSRF [<a href="http://blacksun.box.sk">http://blacksun.box.sk</a>].</p>



<p>[ABOUT THIS TUTORIAL]</p>

<p>This tutorial was not written by me entirely, I gathered information form other sources

on the web (some time ago) like messageboards, advisories etc. I do not know who the original 

authors are, but if you read this and feel that you need some credit for it please drop me a 

line and I will put your name in here somewhere ;-)</p>

<p>A large part of this tutorial originated from a post on Elf Qrin's message board 

[<a href="http://www.elfqrin.com" target="_blank">http://www.elfqrin.com</a>]</p>

<p>The reason for this tutorial is that I was looking for something like this and could

not get hold of it easy... (That is good enough a reason, ain't it? =)</p>

<p>Anyway, here goes, I hope you like it. Send all feedback to 

<a href="mailto:jacorex@hotmail.com">PHaRaoH</a>.</p>

<hr align="center" noshade width="90%">

<p>You can control the way your Win95/98/ME system restricts access to certain areas 

or features (especially useful on multiuser machines) without having to mess with 

Poledit.exe (Policy Editor), the default Windows administrative control tool.</p>



<p>All you have to do is modify the Registry values listed below.<br>

You can either make these changes manually using the Registry Editor (Regedit.exe), 

or save them in a .REG file for future use (name it for example RESTRICT.REG).

Start Regedit and go to: </p>



<p class="white">HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies</p>



<p>Look in the left hand pane for these subkeys:</p>

<ol>

	<li><a href="#explorersubkey">Explorer</a></li>

	<li><a href="#systemsubkey">System</a></li>

	<li><a href="#networksubkey">Network</a></li>

	<li><a href="#winoldappsubkey">WinOldApp</a></li>

</ol>

<p>If they are not present, create them: right-click... New... Key... Name it to one of 

the values listed above.</p>

<p>Now you need to create (or modify if it already exist) the following DWORD values 

listed further below under the subkeys above. To create a new DWORD value: right-click... 

New... DWORD... name it to one of the values listed further below.

To modify one of these DWORD values: right-click... Modify... check the Decimal box... enter 

a value of 1 to disable access to a certain feature, or a value of 0 to enable access to a 

certain feature). These are the valid DWORD values (if not specified otherwise) you can change 

under the following subkeys:</p>

<a name="explorersubkey"></a>

<p>1. Explorer subkey:</p>



<table align="center" border="1" cellpadding="0" cellspacing="0" width="80%">

	<tr>

		<th>

			<p>Keyname</p>

		</th>

		<th>

			<p>Description</p>

		</th>

	</tr>

	<tr>

		<td>

			<p>ClearRecentDocsOnExit</p>

		</td>

		<td>

			<p>enable/disable clear of recent documents upon exit</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>DisableRegistryTools</p>

		</td>

		<td>

			<p>enable/disable registry editing tools<br>

			WARNING: If you disable the Registry Editor, you will NOT be able to modify 

			ANY Registry settings anymore, and the ONLY way to disable system restrictions

			is to run/merge/register a .REG/.INF/.VBS file!</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoAddPrinter</p>

		</td>

		<td>

			<p>enable/disable addition of new printers</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoClose</p>

		</td>

		<td>

			<p>enable/disable system shutdown</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoDeletePrinter</p>

		</td>

		<td>

			<p>enable/disable existent printers deletion</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoDesktop</p>

		</td>

		<td>

			<p>enable/disable ALL desktop items and desktop right-click menu</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoDevMgrUpdate</p>

		</td>

		<td>

			<p>enable/disable Windows 98/ME web update manager</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoDrives [hex]</p>

		</td>

		<td>

			<p>enable/disable ANY drives in My Computer/Explorer/IE<br>

			See "<a href="#hidewin9xdrives">Hide Win9x Drives</a>" for details</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoFind</p>

		</td>

		<td>

			<p>enable/disable the find/search command</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoInternetIcon</p>

		</td>

		<td>

			<p>enable/disable the Internet icon on desktop</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoNetHood</p>

		</td>

		<td>

			<p>enable/disable Network Neighborhood</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoRecentDocsHistory</p>

		</td>

		<td>

			<p>enable/disable recent documents in the Start Menu (Win98/ME/IE4/IE5/IE6 only)</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoRun</p>

		</td>

		<td>

			<p>enable/disable the run command</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoSaveSettings</p>

		</td>

		<td>

			<p>enable/disable save settings upon exit</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoSetFolders</p>

		</td>

		<td>

			<p>enable/disable folders in Start Menu... Settings</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoSetTaskbar</p>

		</td>

		<td>

			<p>enable/disable taskbar in Start Menu... Settings</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoSMMyDocs</p>

		</td>

		<td>

			<p>enable/disable My Documents folder in Start Menu</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoSMMyPictures</p>

		</td>

		<td>

			<p>enable/disable My Pictures folder in Start Menu<br> 

			["NoSMMyDocs" and "NoSMMyPictures" courtesy of <a href="mailto:davidapoole@dartonhigh.freeserve.co.uk">David Poole</a>]</p>

		</td>

	</tr>

	<tr>

		<td>

			<p>NoWindowsUpdate</p>

		</td>

		<td>

			<p>enable/disable the Win98/ME web update </p>

		</td>

	</tr>

</table>



<a name="systemsubkey"></a>

<p>2. System subkey:</p>



<table align="center" border="1" cellpadding="0" cellspacing="0" width="80%">

	<tr>

		<th>

			<p>Key Name</p>

		</th>

		<th>

			<p>Description</p>

		</th>

	</tr>

	<tr>

		<td valign="top">

			<p>NoAdminPage</p>

		</td>

		<td>

			<p>enable/disable the remote administration tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoConfigPage</p>

		</td>

		<td>

			<p>enable/disable the hardware profiles tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoControlPanel [hex]</p>

		</td>

		<td>

			<p>enable/disable the control panel</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoDevMgrPage</p>

		</td>

		<td>

			<p>enable/disable the device manager tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoDispAppearancePage</p>

		</td>

		<td>

			<p>enable/disable the appearance display tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoDispBackgroundPage</p>

		</td>

		<td>

			<p>enable/disable the background display tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoDispCPL</p>

		</td>

		<td>

			<p>enable/disable the display properties applet</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoDispScrSavPage</p>

		</td>

		<td>

			<p>enable/disable the screensaver display tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoDispSettingsPage</p>

		</td>

		<td>

			<p>enable/disable the settings display tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoFileSysPage</p>

		</td>

		<td>

			<p>enable/disable the file system button</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoPwdPage</p>

		</td>

		<td>

			<p>enable/disable the password change tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoProfilePage</p>

		</td>

		<td>

			<p>enable/disable the user profiles tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoSecCPL</p>

		</td>

		<td>

			<p>enable/disable the password applet</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoVirtMemPage</p>

		</td>

		<td>

			<p>enable/disable the virtual memory button</p>

		</td>

	</tr>

</table>



<a name="networksubkey"></a>

<p>3. Network subkey:</p>



<table align="center" border="1" cellpadding="0" cellspacing="0" width="80%">

	<tr>

		<th>

			<p>Key Name</p>

		</th>

		<th>

			<p>Description</p>

		</th>

	</tr>

	<tr>

		<td valign="top">

			<p>DisablePwdCaching</p>

		</td>

		<td>

			<p>enable/disable password caching</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>HideSharePwds [hex]</p>

		</td>

		<td>

			<p>enable/disable shared passwords</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoEntireNetwork</p>

		</td>

		<td>

			<p>enable/disable entire network</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoNetSetup</p>

		</td>

		<td>

			<p>enable/disable the network applet</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoNetSetupIDPage</p>

		</td>

		<td>

			<p>enable/disable the network identification tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoNetSetupSecurityPage</p>

		</td>

		<td>

			<p>enable/disable the network access tab</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoFileSharing</p>

		</td>

		<td>

			<p>enable/disable the network file sharing button</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>MinPwdLen</p>

		</td>

		<td>

			<p>set the minimum password length (integer number: 0 - 99)</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoPrintSharing</p>

		</td>

		<td>

			<p>enable/disable the network print sharing button</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoWorkgroupContents</p>

		</td>

		<td>

			<p>enable/disable network workgroup</p>

		</td>

	</tr>

</table>



<a name="winoldappsubkey"></a>

<p>4. WinOldApp subkey:</p>



<table align="center" border="1" cellpadding="0" cellspacing="0" width="80%">

	<tr>

		<th>

			<p>Key Name</p>

		</th>

		<th>

			<p>Description</p>

		</th>

	</tr>

	<tr>

		<td valign="top">

			<p>Disabled</p>

		</td>

		<td>

			<p>enable/disable Ms-Dos Prompt</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoRealMode</p>

		</td>

		<td>

			<p>enable/disable real Ms-Dos mode reboot option (Win95/98 only)</p>

		</td>

	</tr>

</table>



<p>Similar settings for Explorer, Network and System can be also found under these Registry keys:</p> 



<p class="white">HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Policies</p>

<p>and:</p>

<p class="white">HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies</p>



<p>If there is only one user, the ".Default" key above contains all global system settings. 

If more than one user, each user has its own subkey here, named after the username(s) found

in Control Panel... Users, and the registry settings located under a user's subkey are valid 

only for that specific user. If you double-click on any of these keys, you'll see 3 subkeys in 

the left hand pane: Explorer, Network and System.<br>

Create (or modify if already present) the following Binary [hex] values listed below under the 

subkeys above. To create a new Binary value: right-click... New... Binary... Name it to one 

of the values listed below.<br>

To modify one of these Binary [hex] values: double-click on it... give it a value of 01 00 00 00

to disable access to a certain system feature, or a value of 00 00 00 00 to enable access to a 

certain system feature. Don't type the spaces, they will be inserted automatically.</p>



<p>Explorer subkey valid DWORD values (if not specified otherwise) that can be changed (some are 

valid ONLY for Win98/ME and MS IE 3/4/5/6):</p> 



<table align="center" border="1" cellpadding="0" cellspacing="0" width="80%">

	<tr>

		<th>

			<p>Key Name</p>

		</th>

		<th>

			<p>Description</p>

		</th>

	</tr>

	<tr>

		<td valign="top">

			<p>CDRAutoRun [hex]</p>

		</td>

		<td>

			<p>enable/disable CD-R/CD-RW/DVD-R/DVD-RW drive(s) autoRun<br>

			NOTE: This setting needs specific CDR(W)/DVDR(W) software installed, 

			like Roxio (Adaptec) Easy CD Creator, DirectCD, CD Copier etc.</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>ClassicShell [hex]</p>

		</td>

		<td>

			<p>enable/disable the active desktop shell</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>ClearRecentDocsOnExit</p>

		</td>

		<td>

			<p>clear/don't clear recent docsuments upon exit </p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>EditLevel</p>

		</td>

		<td>

			<p>edit security level (integer number: 0 - 4)</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>EnforceShellExtensionSecurity</p>

		</td>

		<td>

			<p>self explanatory :)</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>LinkResolveIgnoreLinkInfo</p>

		</td>

		<td>

			<p>display/don't display link info</p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoActiveDesktop</p>

		</td>

		<td>

			<p>enable/disable active desktop </p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoActiveDesktopChanges</p>

		</td>

		<td>

			<p>enable/disable changes to active desktop </p>

		</td>

	</tr>

	<tr>

		<td valign="top">

			<p>NoAddPrinter</p>

		</td>