Setting A Password To Access Certain Windows Applications

[BatchTheBrit]

Hi all! I want to add a password to prevent access to certain windows applications.

 

I've got a digital wellness/detox app that blocks selected software at certain times or after a set time allowance. I've also got it to lock my PC after midnight to make sure I don't stay on until like 4am (gotta love the ADHD struggles). The problem is that I can use a cmd/powershell time command to set an earlier system time, preventing it from locking the PC. I've tried blocking cmd but it opens for 1/2 seconds before the software kills the process, giving me enough time to paste the command.

 

Do you know of any way that I can set things up so I require a password to launch cmd (and powershell)? Then I could just set a long, random string, write it down and then give it to somebody. Then I wouldn't be able to circumnavigate the blocks, since I won't remember the password. I would need it to be a separate password to my main user account password though, as I'll still need admin privileges.

Any suggestions would be really helpful, thanks! 

[OddOod]

Okay, THAT is some serious addiction. I would *first* strongly recommend a therapist. You're currently treating a symptom of mental illness, therapy will help address the root cause. I've been there. It sucks. I'm very, *very* sorry, but it can get better.

Now that's out of the way, I have several potential solutions. I see you need admin, but if you don't need CMD/PS, you can set a group policy to disallow it. Another option would be to set up a scheduled task that just runs the "update time from time server" command every minute 

w32tm /resync

You can also require a password for CMD/PS using this method
https://answers.microsoft.com/en-us/windows/forum/all/how-do-i-require-a-password-to-open-command-prompt/425f405f-6ba3-4edb-b8a1-d6af70d32fbe

But ultimately, you're just putting up roadblocks, you aren't actually fixing the problem. You need actual help which we cannot provide. 

[Dedayog]

2 hours ago, BatchTheBrit said:

Hi all! I want to add a password to prevent access to certain windows applications.

 

I've got a digital wellness/detox app that blocks selected software at certain times or after a set time allowance. I've also got it to lock my PC after midnight to make sure I don't stay on until like 4am (gotta love the ADHD struggles). The problem is that I can use a cmd/powershell time command to set an earlier system time, preventing it from locking the PC. I've tried blocking cmd but it opens for 1/2 seconds before the software kills the process, giving me enough time to paste the command.

 

Do you know of any way that I can set things up so I require a password to launch cmd (and powershell)? Then I could just set a long, random string, write it down and then give it to somebody. Then I wouldn't be able to circumnavigate the blocks, since I won't remember the password. I would need it to be a separate password to my main user account password though, as I'll still need admin privileges.

Any suggestions would be really helpful, thanks! 

I would give admin rights to a trusted friend, mentor, family member.

 

Then you wouldn't be able to overwrite?

[BatchTheBrit]

2 hours ago, OddOod said:

Okay, THAT is some serious addiction. I would *first* strongly recommend a therapist. You're currently treating a symptom of mental illness, therapy will help address the root cause. I've been there. It sucks. I'm very, *very* sorry, but it can get better.

Thanks for the thoughtful reply, really appreciate the advice! Yeah, it's bad right? Surprisingly, this is actually part of the work I'm doing with my therapist! We've been working on the root causes with a lot of success but, as I have ADHD, I often do these things without fully thinking about the ramifications. When life is going well, this problem doesn't sprout up often. However, when things get stressful the ADHD symptoms are more severe and I start reverting back to old coping mechanisms. This is explicitly an exercise in damage limitation while I'm still learning, definitely not the only thing I'm working on! I appreciate you starting with this point though, therapy would have been the answer if I wasn't already on that journey  

 

2 hours ago, OddOod said:

Now that's out of the way, I have several potential solutions. I see you need admin, but if you don't need CMD/PS, you can set a group policy to disallow it. Another option would be to set up a scheduled task that just runs the "update time from time server" command every minute 

w32tm /resync

You can also require a password for CMD/PS using this method
https://answers.microsoft.com/en-us/windows/forum/all/how-do-i-require-a-password-to-open-command-prompt/425f405f-6ba3-4edb-b8a1-d6af70d32fbe

Thanks for the suggestions. Having the time resync every minute is a really elegant solution actually, as then I'd still be able to access cmd if I need it. Is there a way for me to prevent changes to that task once I've set it up? Same question with disallowing it through a group policy; wouldn't I be able to just give myself the permission again if I've still got admin? 

 

The regedit solution you linked looks like it may work but that's specifically for preventing it from opening in safe boot. I've been unable to find the location for cmd settings in regedit but I'll have a look through and find it. Either way, thanks for the suggestions, gives me some paths to go down! 

[BatchTheBrit]

1 hour ago, Dedayog said:

I would give admin rights to a trusted friend, mentor, family member.

 

Then you wouldn't be able to overwrite?

I've considered it but would prefer to keep admin if possible. I'm constantly tinkering and doing things that require admin, would be a real pain to keep contacting them for the password. I'd probably also just remember it over time if I'm asking for it a lot. I'd much prefer an option where I'm interacting with the backend of the solution as infrequently as possible as I think it'd be more sustainable! 

[BatchTheBrit]

@OddOod I've also just accidentally revoked my permissions in regedit. Not my permissions to run the .exe, my perms to edit cmd's registry keys 

[Dedayog]

14 minutes ago, BatchTheBrit said:

I've considered it but would prefer to keep admin if possible. I'm constantly tinkering and doing things that require admin, would be a real pain to keep contacting them for the password. I'd probably also just remember it over time if I'm asking for it a lot. I'd much prefer an option where I'm interacting with the backend of the solution as infrequently as possible as I think it'd be more sustainable! 

No offense but this sounds like an excuse.

 

You have an issue, one that seems fairly intense and life consuming, as you put it.

 

The obvious answer is to take the ability to circumvent your own safety mechanism out of your hands.  Yet you want to "tinker".

 

As long as you have the ability to ignore the obstacles you put in place, it isn't going to help you.

 

Best of luck with however you go forward.

[BatchTheBrit]

23 minutes ago, Dedayog said:

No offense but this sounds like an excuse.

 

You have an issue, one that seems fairly intense and life consuming, as you put it.

 

The obvious answer is to take the ability to circumvent your own safety mechanism out of your hands.  Yet you want to "tinker".

 

As long as you have the ability to ignore the obstacles you put in place, it isn't going to help you.

 

Best of luck with however you go forward.

I think I worded my reply incorrectly. I am more than happy to remove admin perms if it's the only way this can work. I'm not trying to make an excuse, I'm trying to find a balance. 

 

I've already given a number of unmemorable passwords to others to enforce blocks, I've even done so for my bios. The blocks on cmd and ps are also set with a password I don't know, but the software doesn't act fast enough. This is the final thing I need to implement before the blocks are cemented and, unless I'm mistaken, I should be able to restrict access to two applications without revoking all of my admin perms. If that is truly the only way, then I'll be revoking the perms and sending the password elsewhere, but I wanted to know what my options were before proceeding. 

[OddOod]

2 hours ago, BatchTheBrit said:

Is there a way for me to prevent changes to that task once I've set it up?

You could probably have the wellness app prevent you from opening Task Scheduler. 
But ultimately, you have physical access; nothing's gonna stop you from just reinstalling windows or running a linux liveUSB. 
 

 

Other things you can do:

Have a scheduled task that has CMD throw up a message on the screen during "bedtime":

msg * "go to bed"

Or even more fun, have it just straight shut down the computer:

shutdown /sg /t 0 /f

 For that I'd consider having the task run a script that checks time and if it's bedtime do the shutdown in order to simplify the triggers. Sadly windows doesn't have anything as powerful as CRON 

[BatchTheBrit]

10 minutes ago, OddOod said:

You could probably have the wellness app prevent you from opening Task Scheduler. 

Aaaand that's the solution. I've set up the time synchro and it works great, I'll just block Task Scheduler and that should be it! Thank you

 

11 minutes ago, OddOod said:

But ultimately, you have physical access; nothing's gonna stop you from just reinstalling windows or running a linux liveUSB. 

That's true, but they're significantly more in-depth circumventions that I wouldn't have the motivation to do in the evening. If I'm so far gone that I reinstall Windows then I'd just sell my PC at that point lmao.

 

Anyway, this setup will break me away from the PC and give me some time for mindfulness. That will make it significantly easier to make the right decision and just go to bed. Thanks for the advice, I think this will work perfectly  

[OddOod]

20 minutes ago, BatchTheBrit said:

Anyway, this setup will break me away from the PC

Fingers crossed for you bud. Here's hoping it's just SAD (hard plug for a daily dose of 5000IU of Vitamin D, massively reduced my symptoms) 
You can also use task scheduler to pop up messages (with msg * "the message") throughout the day with whatever mindful phrase you want like "do box breathing" or "do a meditation" or "say out loud what you are feeling right now"

Good luck!