"Open" option in download doesn't work

TCalder · Post by **TCalder** » Tue Apr 14, 2009 8:20 pm

Ok, let me see if I can explain this well enough...

We are using a GPO to limit accounts at a library to only run allowed executables, dll's, etc. Right now, JPG, GIF, etc files are set to open in Windows Picture and Fax Viewer and this works fine except in one case.

If I go to open an email attachment using PWB and choose 'download' and then 'open' (instead of 'save') in the window that pops up, I get an error saying I do not have permission. After some testing, I disabled the limit on accounts to certain executables and it opened fine using the 'open' command in Windows Picture and Fax viewer. When I turned the limits back on, it would not open in this one method. Every other method (saving to HDD, off a flash drive, etc) all work fine.

The only difference to make it work was that I allowed any executable, bat, dll, whatever to run and that fixed it. It seems when you click on 'open' it is attempting to run some kind of extra dll or something before it opens the file in the already allowed Windows Picture and Fax Viewer. Is this something IE is doing? Is it PWB doing it? Do you know what I need to add to the allowed list so it can work correctly with 'open'?

Thanks!

Post by **Scott** » Wed Apr 15, 2009 8:08 am

All the web browsing in PWB is done via Internet Explorer, PWB only puts a new face on the Internet Explorer HTML rendering engine. So any solution we be related to IE.

I think this may be what you are looking for.

The viewer program starts up if any of the picture format files is double clicked. It is not accessible from the Windows Start menu and is implemented as a dynamic-link library file called shimgvw.dll; there is no executable file.

http://en.wikipedia.org/wiki/Windows_Pi ... Fax_Viewer

--Scott

TCalder · Post by **TCalder** » Wed Apr 15, 2009 5:03 pm

Ok, that answers my question at least, but sadly your information does not help (tried it already). Thanks for the answer though, it tells me where to look then (IE is to blame, how shocking

).

Post by **Scott** » Wed Apr 15, 2009 7:45 pm

The best way to create a run list that I have found is to do the following.

Close all applications.
Make note of all the processes running.
Open what you want to allow.
Make note of all the new process running.

The new processes that are running are usually what you need to add to your run list.

I will do a bit more digging and see if I can narrow it down for you.

--Scott

TCalder · Post by **TCalder** » Thu Apr 16, 2009 5:37 pm

Yah, I might have to do that. I was trying to avoid unlocking the accounts as they are in use all day. Time to make a seperate GPO and do some testing with it. Thanks for the help!

Post by **Scott** » Fri Apr 17, 2009 11:52 am

Try adding "rundll32.exe" to your run list.

--Scott