Suppose Windows users have a legitimate need to run certain Java applications. Is it possible to prevent users from introducing and running their own JVM bytecode?

I have only found methods of running untrusted java code in a sandbox, e.g.

java -Djava.security.manager=COM.abc.MySecMgr SomeApp

However, an untrusted user can simply specify their own security manager or policy file.

java -Djava.security.manager -Djava.security.policy=pURL SomeApp

Is it possible to give users access to some pre-installed Java-based applications, but prevent them from introducing and running other Java applications?


One way to perform what you want it to use a delegate user. That works best with tasks that do not have a GUI but it could work with GUI tasks as well (whether it actually works or not depends on too many details to be described here: you need to experiment)

You need to prevent the windows users from running any Java application (for instance through a change to permissions on the file system where the JRE is located).

You then create a different user that has the necessary right to run your application and write a small script that starts your application. That script must also be protected against modification (at least) by the regular user.

Finally, you create a scheduled task for running your script (optionally, you can run the whol JRE command line from that scheduled task but it's less adjustable) and set it to run as the delegate user. You need to give the regular user a way to start the task: you can explain how do that from the task scheduler itself or, like I prefer to do, set it to run when a specific event appears in the even log and use the eventcreate command in a batch file to add that event.

Another way it is to use Citrix or RemoteApp on a different machine (with a seamless application). You'll need to lock down the session quite a lot to prevent the user from running a command-line.

Finally, on Windows 10/2016, you could try to use a docker container. For automated tasks, that will work just fine. For GUI applications, I'm not sure it can work: I know it's possible on Linux but I haven't tried it on Windows.

  • I was so interested in this question and i can only say to your answer: "WOW" – KanekiDev Nov 11 '16 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy