I am facilitating an management system project in intranet environment(but with internet access for many domain users) for printing barcode labels from a web interface.
1. The current method our vendor employed is to launch a local bar code designing solution from IE and print barcode from there. The software checks license on startup, the webpage passes in a temporary license when invoking it. It will quit with error if launched directly. Their webpage use WSH FSO to launch this exe, we have to enable insecured ActiveX content in IE setting for this to work.
Our company deployed policy blocks all writing operations by regular users to
C:\Program Files folder, and nothing outside of
Program Files folder is executable by user other than administrators. Effectively rendering all executables read-only, writable files in-executable.
But this barcode software needs to write to a lic file in its program folder.
So here is the second dilemma. If placed outside of
Program Files it will not execute, if placed inside, it will crash on error, due to a unwritable lic file. It was suggested to assign the user to administrator group.
Adding together, it sounds a security nightmare.
My current solution to Issue1 to add this intranet address to trusted sites list and allow trusted zone to run insecure activex content. For Issue2, since there are multiple ways from different layers to prevent program from running (ACL,group policy,etc), I locally added Full control permission of the lic file to current domain user, so that the program can write its lic.
Though I still not feel comfortable with the vendor's way of label printing. I think the current workaround I proposed have minimum negative impact on current system security. But I am open to different opinions.
Another thing, if we move on to Window10, will win10 still support the scripting objects?