Why not just explicitly exclude "c:\adsm.sys\...\*" and put "domain c: d: e: f:" in a secure dsm.opt and take "execute" off dsm.exe for the users?
Tony Morgan Fortis Bank UK ============================================================ This e-mail and any files transmitted with it, are confidential and intended solely for the use of the addressee. The content of this e-mail may have been changed without the consent of the originator. The information supplied must be viewed in this context. If you have received this e-mail in error please notify our Helpdesk by telephone on +44 (0) 20-7444-8444. Any use, dissemination, forwarding, printing, or copying of this e-mail or its attachments is strictly prohibited.
