VanguardLH
Tue Mar 18 11:44:58 PDT 2008
<exg001@gmail.com> wrote in message
news:6b3e1660-e082-4e90-a352-23d5d3163ad1@f63g2000hsf.googlegroups.com...
>
> "VanguardLH" wrote:
>
> <exg...@gmail.com> wrote ...
>
> > At work, we are still running NT. Unfortunately, one of the
> > servers
> > is
> > Terminal Server so I have a lot of users using it and surfing.
> > Just
> > about every site in the world is using Adobe's Flash Player, but
> > the
> > latest you can have on NT is version 7.
>
> > All I want to do is prevent Flash from trying to get the latest
> > version for my users. It's a selfish reason: they keep getting
> > error
> > messages, and the server's hard drive keeps filling up with a
> > million
> > copies of FP_AX_CAB_INSTALLER.exe in DOWNLOADED PROGRAM FILES
> > folder.
> > So every now and then, I have to clear out 1 GB of junk from
> > there.
>
> > I have tried setting IE to disable Install on Demand (Other). I
> > even
> > tried putting 0.0.0.0 download.macromedia.com in the hosts file.
>
> > I hate Flash, but I know it's used. Any idea how I can prevent
> > this?
>
> > BTW, the error message users get (regardless of admin or not):
>
> > Adobe Flash Player ActiveX Setup
> > Failed to install. For troubleshooting tips, please see
> >
http://www.adobe.com/go/tn_19166
>
> Rather than trying to push a hosts file onto your workstations, and
> since they probably are configured to use DHCP which means they use
> *your* DNS server, why not block the IP address lookup in your DNS
> server?
>
> As an example, I use OpenDNS from home. In my account there, I can
> block lookups on specified domains. So when someone or a program
> tries to connect to <somesite> then the DNS lookup will fail and the
> someone or program will not get an IP address. Humans want readable
> IP names. Computers require IP addresses. If the computer doesn't
> get the IP address, it can't connect to that host. It is unlikely
> that users are going to use IP addresses to circumvent the DNS
> lookup
> rejection. Programs are rarely encoded to use IP addresses and
> instead will use an IP name which requires the DNS lookup.
>
> I am suspect of your intention. Someone claiming to be an
> administrator over users (plural) would have their own e-mail
> account
> at their own mail server or e-mail provider and not using a Gmail
> account, and they would be posting using a real newsreader rather
> than
> through Google Groups. Real admins don't post through Google Groups.
> Real admins have a real e-mail address (or will munge it or not even
> use a valid one when posting to Usenet).- Hide quoted text -
>
> - Show quoted text -
I appreciate your little idea, regardless of the fact that you are not
fully reading my post. I will try blocking some site at my
DNS...maybe all of *adobe.com*.
As for my real intentions and using my own gmail account and posting
on Google Groups instead of using a 'real' newsreader, what exactly
would my "intentions" be other than what I stated? Of course you
didn't fully read it, so I can't expect a proper answer.
Thanks anyway.
--- REPLY SEPARATOR ---
Only required because above poster used QUOTED-PRINTABLE format.
When posting to newsgroups, do NOT use quoted-printable format.
* Not all NNTP clients handle quoted-printable format.
- Some users still use console-mode (non-GUI) NNTP clients.
- The long lines may not wrap properly.
- Scrolling is needed if the long line does not get wrapped.
- The long line may get truncated at the window's width.
- Quoted-printable format uses special character sequences for
logical formatting. View the raw source of your post. Text-
only clients may show that encoding when viewing your post.
* Quoting levels get mangled, especially for multiple replies.
* In replies, there is no clear delineation of content.
- Cannot tell what content is from the original poster and
what is from the respondent.
- Makes impossible to determine who said what when a reply
inserts comments inline with the quoted content.
---[end of comments]---
Hence another reason not to use Google Groups because it will
sometimes decide to use quoted-printable format which is not
appropriate for Usenet posts, and fucks up quoting.
That the users are using their own workstations or using TS to one
host to connect to the Internet from there is somewhat irrelevant. TS
only lets you focus *local* solutions on that host to which the users
connect. Blocking access to the sites using DNS rejection is one way.
You could do the DNS rejection for all users at the company or you
could create an account just for that TS host which has its own
blocking rules. Blocking URL substrings or IP addresses at the router
is another solution, and you can probably even specify for which hosts
the blocking is implemented, so you could make it global or local to
just the TS host. Using a software firewall running on just that TS
host to use a rule to block on URL or IP addresses is another solution
to block just the TS users.
It seems you have lots of methods of blocking users from getting the
flash update.