Bardon Data Systems: Full Control Internet FAQ

Product Overview

Configuration and Troubleshooting

• What is a group? How do I add a new group?
• How do I add a user?
• How can I control which users can log on?
• How do I set time limits for a user?
• How do I set what happens when a user runs out of time?
• How can I prevent users from using Ctrl+Alt+Del?
• How can I prevent users from using Safe Mode?
• How can I prevent users from starting the computer in DOS?
• What is an Allowed Application?
• What is a managed program?
• What is a non-managed program?
• How do I add a managed program to a group's settings?
• How do I clone a Full Control computer's entire configuration onto another machine?
• How do I save a computer's Full Control configuration to a clone data file?
• Can I use a clone data file to copy settings while installing?
• How do I install Full Control from a network server?
• How do I use the Remote Administration Manager to dynamically update all my managed computers over a LAN or the Internet?
• How do I monitor World Wide Web usage?
• Can I give times of day when no programs can be run?
• How do I set time limits for a program?
• How do I password-protect a program? How do I require biometric validation to run it?
• When a program runs out of time, how do I prevent the user from just starting it again?
• I want a certain program to run, but remain minimized. How do I do this?
• How do I track system usage?
• How long do Full Control's message screens stay visible?
• How do I prevent people from using Windows "common dialogs" as little Explorer windows?
• Can I control whether the user can logoff, shut down or restart the computer?
• How do I know who ran what program? How can I see reports?
• When I try to run a program's Help screen, Full Control closes the Help window. How do I fix this?
• I rebooted after an abnormal shutdown and now nothing will run. What do I do?
• My computer doesn't shut down properly. What should I do?
• In Win98 or IE4/5, changing the Start menu restrictions won't update my settings until the next logon.
• What is the issue regarding January 1 2010? Why do I need to upgrade older versions before that date?

Product Overview

What is Full Control Internet? What does it do?

Full Control Internet is a comprehensive management system that cuts the time and effort spent maintaining Windows PCs enterprise-wide. It allows administrators to manage and oversee hundreds or even thousands of computers simultaneously, over the Internet, from anywhere in the world. This includes mobile computers that may not always be connected to the enterprise network. The managed computers can be monitored and updated individually or in groups. User activity can be logged, audited, and controlled. Helpdesk and support staff have a new worldwide channel for remote file updates, user communications, computer maintenance and remote repair. These powerful tools strengthen administrative capabilities and improve remote management of systems. In addition, Windows itself can be hardened, inherently making the computer more reliable, stable, and secure.

Full Control Internet allows the administrator to dynamically monitor and control all managed computers worldwide from one central location. This includes the ability to remotely update, logoff, shut down, reboot or reconfigure Full Control Internet stations. The administrator can remotely roll back settings to a previous configuration, initiate realtime two-way chat, or broadcast popup text messages to any or all managed computers. Full Control Internet can even send alerts on administrator-definable anomalous events.

Full Control Internet's One Click System Stabilization allows full user access to authorized software yet prevents accidental or malicious system modifications. The software also includes a potent set of features to manage user access to software programs and system configuration, monitor Web browser activity, allow time management, and control user right of entry. It can make files or folders read-only or invisible to prevent unauthorized access. It can control any window, such as Options dialogs or Control Panel applets, through which the user might change settings or access the file system. It can deny or password-protect Ctrl+Alt+Del and similar keys. It can prevent users from bypassing Windows at startup, lock the CD-ROM drive to prevent removal of valuable CDs, and provide a minute-by-minute audit trail of all system activity.

What are the differences between WinU, Full Control, and Full Control Internet?

The WinU and Full Control products provide comparable security access control, but do this in different ways. Each product has its own advantages. To learn more about which product will best meet your needs, click here.

What kinds of protection does Full Control Internet provide?

On the client computer, Full Control Internet allows users access to authorized software, yet prevents accidental or malicious system modifications. It lets the administrator specify the amount of time that each program can be used, while allowing a warning "grace period," with customizable length and warning message, before terminating a running application. Full Control Internet can monitor all Web browser activity, logging all accessed websites and the amount of time at each site. It can make files or folders read-only or invisible to prevent access to unauthorized data. It can monitor and control any window, such as File Open and Save As dialogs, with which the user might access the file system. Full Control Internet can monitor changes to important system files, and "roll back" to any previous configuration. In addition, Full Control Internet can deny or password-protect Ctrl+Alt+Del, the Delete key and right-mouse context menus in Explorer and World Wide Web browsers, and the Windows and Apps keys found on newer keyboards. Full Control Internet can disable the keyboard at startup to prevent users from bypassing Windows, and it can lock the CD-ROM drive door to prevent the removal of valuable CDs.

All client-computer activity is logged to Full Control Internet's server, the "Remote Administration Manager." With this management tool, the administrator can oversee and control hundreds or even thousands of computers simultaneously, either over an in-house LAN or over the Internet from anywhere in the world (dcetails below).

What sort of organizations can benefit from Full Control Internet?

Full Control Internet is useful for businesses that want to let employees use only authorized applications, for schools and public institutions that need to give patrons access to specific programs yet safeguard the computer against tampering, and for similar organizations. The end-user has full access to authorized software, but can't change the computer's setup or delete important files. Full Control Internet is easy to set up, and it prevents users from modifying the computer's configuration. It can be considered in any situation in which users need access to software without the option of reconfiguring the computer.

Does Full Control Internet include remote administration capabilities?

Yes. Full Control Internet allows administrators to manage and oversee hundreds or even thousands of computers simultaneously, either over an in-house LAN or over the Internet from anywhere in the world. This includes mobile computers that may not always be connected to the enterprise network. The managed computers can be monitored and updated individually or in groups. User activity can be logged, audited, and controlled. Helpdesk and support staff have a new worldwide channel for remote file updates, user communications, computer maintenance and remote repair. These powerful tools strengthen administrative capabilities and improve remote management of systems. In addition, Windows itself can be hardened, inherently making the computer more reliable, stable, and secure.

The administrator can dynamically control all access enterprise-wide from one central location. This includes the ability to query the status of Full Control Internet stations; update, logoff, shut down, reboot or reconfigure Full Control Internet stations remotely; realtime two-way chat or one-way popup text messages, either to individual Full Control Internet stations or broadcast them to all managed computers.

Any Full Control Internet computer can be remotely and dynamically reconfigured. The administrator need only create one master setup (which can include per-computer customizations if desired) then distribute it over the LAN or the Internet. Full Control Internet includes the Remote Administration Manager to control the situation from anywhere on the LAN or the Internet.

What activities can Full Control Internet monitor?

Full Control Internet's built-in activity logging audit trail can track exactly when each program was run, by whom, and for how long. In addition, Full Control Internet can track attempts to access locked files or folders, attempted password hacking, World Wide Web browser usage, and more. Full Control Internet's built-in reports and graphs can analyze this information, or the data can be exported to any database or spreadsheet.

Does Full Control Internet run on the server or the client machine?

Full Control Internet runs as a server application (the "Remote Administration Manager") through which the administrator can manage and monitor the computers in real-time. The Remote Administration Manager communicates over the Internet with a client component which is installed on each individual computer. Through this Internet connection the computers can be overseen and managed from anywhere in the world.

However, a permanent "always-on" Internet connection is not required. In the real world, not all computers are always connected to the LAN or the Internet. Standalone computers need protection too. For example, consider an account rep who carries a laptop containing sensitive information. It's not connected but still needs to be secure. Also, servers and networks can go down. When that happens, you don't want your security going down with it. As long as the client component runs on the managed machine, Full Control Internet will provide protection. When the client next connects with the server, all its stored data and logs will be uploaded.

What are Full Control Internet's main features?

• Internet-based central administration
• World Wide Web browser monitor
• Can prevent Web browser from accessing files on local hard disk
• Read-only or invisible files and folders
• Desktop configuration control
• Prevents desktop icons from being moved or renamed
• Ctrl+Alt+Del blocking
• Windows/Apps keys blocking
• Dial-Up Networking control
• CD-ROM door locking
• Individual time limits and security settings for each application
• Individual time limits and security settings for each user
• Password protected Safe Mode
• Define blockout periods, during which nothing is available
• Waiting periods before an application is allowed to restart
• Window Monitor can manipulate or close any window when it appears
• Set Open/Save dialogs to that user's proper directory
• Diagnostic tools to aid in helpdesk support
• Configuration monitor: save and restore system configuration
• Configure one Full Control Internet computer, then distribute copies enterprise-wide
• Activity log monitors program usage
• Built-in reports and graphs, or export data to any database or spreadsheet

What are Full Control Internet's system requirements?

Full Control Internet runs on any Windows computer (95/98/ME/NT/2000/XP). It includes a thorough Windows-standard uninstaller. Its files take up 1 to 2 MB of hard disk space, depending on the options selected.

What is Full Control Internet's price and availability?

Full Control Internet is shipping now. Price is $79.95 single copy, less when purchased in quantity. Discounts are also offered for educational institutions, VARs/resellers, and current Bardon customers. A "test-drive" evaluation version can be obtained from the Bardon Data Systems World Wide Web site (www.bardon.com).

Configuration and Troubleshooting

What is a group? How do I add a new group?

A "group" is a set of settings. A user is given one group's setting at logon. The Full Control Internet group can be derived from the Network Domain groups in which this user is a member. This makes administration very easy because you do not have to maintain two separate lists. Or if necessary, a user's group can be explicitly listed with Full Control Internet. Either way, when that user logs on, the group's settings are applied. To add a group, bring up the Groups screen and click the Add button. The Group Setup screen is displayed, which lets you name the group and provide all its settings.

How do I add a user?

At logon, each user is given one group's settings. Since a user's Full Control Internet group can be derived from the Network Domain groups in which this user is a member, it's rarely necessary to explicitly list all users. However, you can list any users you want to, perhaps to list "special case" users and their Full Control Internet group. To add a user, bring up the Users screen and click the Add button to list the user's logon name. On this screen, you can also import a large number of users at once from a file.

How can I control which users can log on?

Use the logon validation options on the Security tab of the System Setup screen. You can set this to allow access only to users known to Full Control Internet, or only to users known to Windows, or to rely on your network-based logon validation.

How do I set time limits for a user?

At logon, each user is given one group's settings. To set a user's time limits for the Windows session, modify the settings for that user's group. On the Configuration screen, click the Groups button and choose a group. The Group Setup screen will be displayed. Go to the Time Control tab. In the Total Minutes Allowed box enter the number of minutes allowed for members of this group. In the Grace Period box enter the number of minutes before timeout at which Full Control Internet will show its warning screen and play its warning sound. (Both the warning screen and the warning sound can be disabled.) Choose how often the maximum time will be reinitialized. Every day at midnight? Every week at Sunday midnight? Every time the user logs on to the user? Never? Up to you.

How do I set what happens when a user runs out of time?

To set what should happen when a user runs out of time for the Windows session, use the Security tab of the System Setup screen to choose whether to logoff the user, shut down the computer, or display a "no time left" screen and prevent access to anything other than that screen.

How do I set time limits for a program?

You can set time limits for individual programs, to be put into effect when this user is logged on. What group is this user in? Open the Group Setup screen, go to the Managed Programs tab, and select the application for which you wish to set a time limit. In the Minutes Until Warning box enter the number of minutes Full Control Internet should wait before a time-out warning is issued. In the Minutes Until Termination box enter the number of minutes you would like the application to run. This number must be higher than the Minutes Until Warning. If you want the application to be inaccessible for a period of time after termination you can set the Minutes Until Restart Permitted. Click Change to update this program's settings.

How do I password-protect a program? How do I require biometric validation to run it?

You can set up almost any Windows program so it is inaccessible unless the user gives its password and/or biometric validation. To do this, set up the application as a Managed Program. You can provide a password on the Managed Programs tab. If you like, you can also require biometric validation to run this program, for example a fingerprint scanner. Set this on the Advanced screen for this program.

How can I prevent users from using Ctrl+Alt+Del?

In Windows 9x and NT, Full Control Internet can completely disable Ctrl+Alt+Del, or password-protect it. In Windows 2000 and XP, the Windows Security (Ctrl+Alt+Del) screen which appears has all functions grayed out. Either way, to disable Ctrl+Alt+Del, select the group to which you want to add this protection. On the Input Control tab, check the box to disable Ctrl+Alt+Del. If you give it a password, in Windows 9x and NT when the user presses Ctrl+Alt+Del the password box is displayed before the Ctrl+Alt+Del proceeds.

How can I prevent users from using Safe Mode?

Full Control Internet can password-protect the Windows 9x and XP Safe Mode. To set this up, go to the Security Settings tab of the System Setup screen. Check the box which controls Safe Mode protection. With this in place, the Full Control Internet setup password is required to use Safe Mode.

How can I prevent users from starting a computer in DOS?

There are two parts to preventing a user from starting a computer in DOS. The first step is to set up Full Control Internet to disable the keyboard at startup (set on the System Setup screen, Security tab). The second step is to change your computer's boot sequence to make sure it tries to boot from your C: drive before trying your A: drive (set in your CMOS).

Changing the computer's CMOS boot sequence ensures that the computer can't be booted from a floppy disk unless the normal hard disk is unavailable. Setting this is system-dependent. Accessing your CMOS is usually accomplished by pressing the DELETE or F10 key during the boot-time system memory test (the first screen you see when your computer starts). Once in setup look for 'boot sequence' or 'boot order'. This specifies the order in which your drives are accessed. Change the boot sequence from A,C to C,A. This will cause a boot disk in the A drive to be ignored at boot-time unless there is no C drive. You should also password protect your CMOS to prevent anyone from changing these settings back. Be very careful when changing your CMOS settings. Doing the wrong thing can render your computer inoperable.

What is an Allowed Application?

Full Control Internet can restrict the programs which can be run by a user. Applications listed as Managed Programs are always allowed to run, subject to their individual time and password/biometric restrictions. As for other programs, if the Access tab's restrictions have been activated, other ("non-managed") programs can be run only if they are listed on that tab as Allowed Applications. See the discussion of that tab's features for more options when setting up Allowed Applications.

What is a managed program?

A managed program is one that is listed on a group's Managed Programs tab. It can have password/biometric restrictions, time limits, restart control, and other settings. If desired, Full Control Internet can terminate managed programs when the user's session runs out of time. Different groups will have different lists of Managed Programs.

What is a non-managed program?

A non-managed program is any running application which is not listed on a group's Managed Programs tab. Non-managed programs are logged when they start and end, but no per-program time or password control is imposed. If desired, Full Control Internet can terminate non-managed programs when the user's session runs out of time.

How do I add a managed program to a group's settings?

Start Full Control Internet and go into Setup mode. Choose a group and click Change to open the Group Setup screen, then flip to the Managed Programs tab. Enter the Program Label, the Executable File, and any other settings you want, then click the Add button at the bottom of that tab.

How do I automatically copy a Full Control Internet computer's entire configuration onto another machine?

You can easily clone Full Control Internet installations. Set up Full Control Internet on one machine, the way you want it with all desired settings and programs. Then use the "clone" feature (System Setup screen, Remote Management tab) to save that configuration as a clonefile. Usually this is set up and saved from the Remote Administration Manager, so the updated clonefile settings can be distributed to the managed client computers in a single step. A clonefile can also be created from a client computer. Of course, to use the same managed programs the other machines must have the same applications in the same-named directories, etc.

How do I save a computer's Full Control Internet configuration to a clone data file?

To create a clonefile containing all the settings of the computer you want to copy, go into Setup Mode and click Export Clone File. By default this file will be named clonefci.bds which is the name needed by Full Control Internet's AutoUpdate processing. Usually this is done from the Remote Administration Manager, but it can also be done from an individual client computer.

Can I use a clone data file to copy settings while installing?

Yes. Copy a clone data file named clonefci.bds to the install disk or network folder from which the install will be run. Install Full Control Internet from that network folder or disk. Because you have copied clonefci.bds to the same directory as the install program (install.exe), you will be asked during installation if you wish to copy the clone information to the new computer. After installation, the new computer will have the same Full Control Internet settings as the master system. (Note: if doing an automated "quiet" install, the clone settings are copied with no user input required.)

How do I install Full Control Internet from a network server?

You want to run the Full Control Internet installer from a network directory which is visible on the target computer (the one you want to install onto). To do this, copy all the Full Control Internet files (from the install disk or download) to a network directory which is visible on the target computer. You can do a regular interactive install, or an automated "quiet" install. Either way, you'll launch install.exe on the target computer, using appropriate command-line parameters if doing a "quiet" install. If you are doing an interactive install, you will be prompted for the target directory. You must choose a directory on the local computer, because Full Control Internet will not run if installed to a network directory. If you have also placed a clone data file named clonefci.bds into the same directory as the Full Control Internet installer program, you will be be able to copy the clone information to the new computer.(Note: if doing an automated "quiet" install, the clone settings are copied with no user input required.)

How do I use the Remote Administration Manager to dynamically update all my managed computers over a LAN or the Internet?

You can use the Remote Administration Manager to send updated clone data to any or all selected computers, and set up the target computers to update their settings. To do this, save the master settings to a clone data file, as described above. On the Remote Administration Manager, highlight the computers you wish to update. Then on the Clones menu, choose Send A Clone File and list the clone data file to be sent.

How do I monitor World Wide Web usage?

Full Control Internet can monitor all websites that are visited while Full Control Internet is running. To activate this feature, use the Event Log tab to set up Full Control Internet for logging, and check the web browser monitor box on that tab. Full Control Internet will log the website URL, title and the number of minutes at each site, for all websites visited through Netscape or Internet Explorer version 3 or later. This information can be viewed through Full Control Internet's built-in reports.

Can I give times of day when no programs can be run?

Yes. In addition to the restart control and cumulative time testing, you can also set per-group blockout periods, for example "Every Tuesday 9 pm to 11 pm" or "Every weekday 7:30 pm to 8:30 pm". A group can have any number of blockout periods. During these periods, no programs will run while a member of that group is logged in, except those managed programs you have specifically allowed to run for a timed-out user.

When a program runs out of time, how do I prevent the user from just starting it again?

You can set up restart control for any managed program. This is done from the Managed Programs tab of the Group Setup screen. Full Control Internet won't let the user restart a program sooner than the restart time you've set up for that program. If this is set, then after a program is exited (or forcibly terminated by Full Control Internet), it cannot be restarted again until that much time has passed. Program restart control, cumulative time limits, and blockout periods can track usage regardless of logons and logoffs.

I want a certain program to always run, but remain minimized. How do I do this?

To start a program at logon and keep it running throughout the user's session, set it as a Managed Program and, on the Advanced screen for that program, check the box labeled AutoRun, then keep program running until logoff or timeout. This is more secure than putting the program in the computer's Startup folder because running a program from Startup can be bypassed by the user and does not keep the program running throughout the session.

To keep the program minimized, set Full Control Internet's Window Control to look for that program's titlebar text and send such a window the keystrokes % N (percent, space, letter N). This sends an Alt+Spacebar to bring up its System menu, then N to activate the System menu's Minimize command.

How do I track system usage?

You can set up Full Control Internet's built-in logging to track usage to the level of detail which is of interest to you. From the Configuration screen choose System Setup, go to the Event Log tab, and select the types of events you want to track.

How long do Full Control Internet's message screens stay visible?

By default, Full Control Internet's password screen will time out and go away after thirty seconds, but you can set this to a different value if you like. Full Control Internet's big-font popup messages time out and go away after two minutes.

How do I prevent people from using Windows "common dialogs" as little Explorer windows?

Most Windows programs use the standard Windows "common dialogs" to open or save files. Presenting the same dialogs in all programs means that the user does the same thing in the same way in all programs. This is good. However, by default these Open and Save dialogs let the user right-click on any displayed file or program and change its attributes, or even run it. They also let the user delete selected files with the Delete key. This is bad. To plug these security holes, check the box on the Input Control tab labeled "Lock down Windows Explorer, the desktop, and open/save screens." This will disable right-click menus and the Delete key in these common dialogs. They are also disabled in Explorer and on the Windows desktop.

Can I control whether the user can logoff, shut down or restart the computer?

Yes. Go to the Group Setup screen's Input Control tab. In the Start Button Options section, check the box labeled Disable the Logoff command or Disable the Shut Down command. If you want to allow password-protected logoff or shut down, provide passwords on the Input Control tab which can be used with Full Control Internet's tray icon menu. Also, the setup password will always allow access to these menu items.

How do I know who ran what program? How can I see reports?

Full Control Internet features detailed logging of events. It also has built-in usage reports which summarize this information to let you see who is doing what. These reports can be viewed and printed from the Remote Administration Manager.

When I try to run a program's Help screen, Full Control Internet closes the Help window. How do I fix this?

You have set up this group to not allow non-managed windows. To allow all helpfiles, list winhelp.exe (the Windows help program) as an Allowed Application by filename, so Full Control Internet allows it to run. To allow just certain helpfiles to run, use the lenient setting instead of strict, and list the window titles of the allowed helpfiles instead of the filename of the help program itself. To add this, on the Group Access tab click the button labeled Filenames or Window Titles, as appropriate. Enter the actual filename or title bar text that you want to allow. Click Add, then click OK. Click OK again. Help should now run.

I rebooted after an abnormal shutdown and now nothing will run. What do I do?

If you have controlled Allowed Applications with the strict option, and if for any reason Full Control Internet does not exit normally, the low-level "don't run" settings will still be in place, and almost nothing on your computer will run. This is rare, but computers are not infallible. If it happens, Full Control Internet provides a number of recovery options. They are listed below in the recommended order.

• Generally Full Control Internet itself will still run, so just start Full Control Internet and exit (immediately if you like). Doing so will clear any leftover control settings.

• If you cannot run Full Control Internet in regular Windows, start your computer in Safe Mode and launch Full Control Internet while there. The strict security settings are ignored while in Safe Mode, so Full Control Internet will always run. Launch Full Control Internet and then exit normally; the security settings will be cleared. Then reboot in regular Windows and you'll be back to normal.

• In Windows 9x, another way to reset to your prior settings is by restoring the user.dat and system.dat Registry files. Each time Full Control Internet starts, it saves backups of these two files as userfci.bds and sysfci.bds in your Windows directory. These backups contain no security restrictions, so using them to restore your user.dat and system.dat files will clear any restrictions. However, you will lose any system configuration changes you made since they were backed up. You may need to boot from a floppy disk to a DOS prompt to copy these files. To restore them, copy userfci.bds to user.dat and copy sysfci.bds to system.dat. All are hidden, system, read-only files in your Windows directory. Use the DOS command ATTRIB to make both sets of files visible so you can manipulate them.

• In Windows NT, 2000, or XP you can restore the Registry as per the previous paragraph with the use of an Emergency Recovery Disk.

My computer doesn't shut down properly. What should I do?

Full Control Internet offers three ways it can shut down your computer. Strong Shutdown is the most secure, however some computers hang at exit when using the Strong method. If this happens, try the Medium or Soft shutdown method. This is set on the Security tab of the System Setup screen.

In Win98 or IE4/5, changing the Start menu restrictions won't update my settings until the next logon.

This is a documented bug in the Windows 98 / Internet Explorer interface. It is not a problem in Windows 95, ME, NT, 2000, or XP, where if you go into Setup Mode or exit from Full Control Internet, your Start menu is immediately restored. But the Win98/IE4 taskbar and Start menu only accept updates at logon - even if you go into Setup Mode, or completely exit from Full Control Internet, you'll find that the elements you removed from the Start menu won't be replaced. To handle this, Full Control Internet has a special option to force Windows to re-read these settings. Go to the first tab of the System Setup screen and check the box labeled Reset the Windows interface on exit.

What is the issue regarding January 1 2010? Why do I need to upgrade older versions before that date?

If you are using older versions of Bardon software, you should upgrade before the end of 2009. For most of you this will be a free upgrade under your Maintenance Plan subscription.

Why? Many years ago we began including a date/time "sanity check" with all of Bardon's software, because we noticed a number of programs that would go haywire if the system date was maliciously set into the far future. To prevent this, if the system date was set in the far future, our software set it back to a reasonable date.

That "far future" trigger date was January 1 2010. When older versions of our software see that (or later) as the system date, they will change the system date to a date between 2002 and 2006, depending on what version you have. So if you are using older versions, you will want to upgrade to the current release.

The relevant versions are

WinU 4.x and 5.x
Full Control 1.x and 2.x
Full Control Internet 1.x

Some versions of WinU 6 and Full Control 3 are also included.

If you aren't sure whether your version is included, or just want to check, feel free to contact us to ask.