Admin control of Skype features

By Kurt on March 9, 2006 in Skype security features.

I just got back from Japan, where we held a seminar about Skype security features with some developers and customers. One of the things I learned was that we haven't gotten the word out about the ways that IT administrators can set enterprise-wide policies on Windows computers running Skype. There are a couple of controls that were very important to the IT administrators I spoke with, and those were features to disable API interfaces and to disable file transfers on a particular instance of Skype.

These controls are enabled by setting particular Windows registry keys, which of course can be pushed out via Windows Server policy objects and controlled using normal ACLs:

Under the registry key [HKLM\SOFTWARE\Policies\Phone], you can set either or both of the following registry keys:

"DisableApi"=dword:00000001
"DisableFileTransfer"=dword:00000001

Setting the DisableApi key to 1 will completely disable the Skype public API interface. This could be helpful when enforcing an enterprise policy concerning the use of software plug-in modules. Setting the DisableFileTransfer key to 1 will disable file transfer. In this case, inbound file transfers will be automatically rejected (the remote user will see a "Cancelled" message) and outbound file transfers will cause a messagebox to pop up containing an error message. (At present, these controls are available only on Skype for Windows.)

One of the comments I received from an IT administrator in Tokyo was that we should provide more granular controls covering more of Skype's functionality elements, so that more locked-down business environments could authorize or restrict access to, say, text chats or to voice calling as well. It would be interesting to know how useful end-users and IT administrators would find such controls.

View blog reactions

Comments

I've noticed Skype has a lot of partners? clients? in Japan such as Livedoor and Buffalo. I personally know a lot of Japanese using Skype. But a lot have been wondering why there is no Skypein for Japan??!! Are you guys considering getting Skypein for Japan? Japan has VoIP dedicated phone numbers (the 050 numbers). It would be great if you guys get this for Skypein

We've had SkypeIn Japan for some time. Please take a look via https://secure.skype.com/store/skypein/start.html It's supplied to us Fusion - and you have to be a resident in order to comply with Ministry rules, but if you are, it's here now.

Yes, granular security is a VERY good idea. Especially only selected programs that can use the API and the potential over-ride of many other settings. But this looks good so far!

PLEASE proivide more granular control. This would be a HUGE step to getting widespread Skype deployment to our 250 users.

That's great! I wonder why I didn't notice the Skypein for Japan before ops:

Hi Kurt,

I have some question about your recent comment on March 09, 2006.
>Under the registry key
>[HKLM\SOFTWARE\Policies\Phone], you can set either >or both of the following registry keys:
>"DisableApi"=dword:00000001
>"DisableFileTransfer"=dword:00000001

question 1: about registry key.
>[HKLM\SOFTWARE\Policies\Phone]

The above registry key on your comment is correct?
I assume the key is like follows
[HKLM\SOFTWARE\Policies\Skype\Phone]

question 2: technical difficulty (Oh No!)
I configured the above key(both way I tried) in the registry,
but the skype still allow me to access to the File Transfer Function.

My Skype version is 1.4.0.84.

I would appreciate it if you provide information for me.

The reason of my question is,
recentry our head company in Japan requested us to uninstall all the version of skype,because of the security vulnerability.

They said, the skype has/can,
1. File Transfer Function.
2. Allow access to the API.

I tried to search about "To disable File Transfer Function" on the web, and found some article about it on your knowledge base, however it was not work propery.

* I am not sure I can post this article here.
* If you think here is not a palce to do this.
* Please let me know.

Thank you.

Takashi (TED) Ueno

I can't find the registry key:

>[HKLM\SOFTWARE\Policies\Phone], you can set either >or both of the following registry keys:
>"DisableApi"=dword:00000001
>"DisableFileTransfer"=dword:00000001

I found HKLM\Software\Skype\Phone - I didn't find diable file transfer or API, so I created them. Fiel transfer still works.

What's the fix?

Rich

Rich,

Also, I found another way(Key?) to disable file transfer function in the other article(in Skype FAQ).

Please look up the article below.

!! Disable File Transfer !!
http://support.skype.com/index.php?_a=knowledgebase&_j=questiondetails&_i=631

!! Disabled access to the API !!
http://support.skype.com/index.php?_a=knowledgebase&_j=questiondetails&_i=632

However, the above article has a different keys than the one described by Kurt.

So, I am confused.

Anyway, you can try.

Good Luck.

Ted

Try the below if HKEY_MACHINE does not work, it will work with CURRENT_USER (perhaps due to XP user profile):

[HKEY_CURRENT_USER\SOFTWARE\Policies\Skype\Phone]
"DisableFileTransfer"=dword:00000001

I've tried disabling file transfer in both HK local machine and HK Current user. Neither work unfortunately.

It would be nice if Skype created an ADM file to control some of the functionality within the client: http://download.microsoft.com/download/1/7/2/1725520f-1228-4dff-9c5d-594042475844/rbppaper.doc

I've tried same thing. Neither work unfortunately.
Is there anyone can help us!!

I've got file sharing disabled at the HKLM\SOFTWARE\Policies\Skype\Phone location in registry. Reason it wasn't working is because of the version of Skype software. download the newest version (2.0.0.97) and when you click send it will advise that it is disabled.

I've installed 2.0.0.97 and the key HKLM\SOFTWARE\Policies\Skype\Phone doesn't exist. The only key present is HKLM\SOFTWARE\Skype\Phone. I created the reg key's and dwords that are supposed to be there. File transfer still works.

Come on you guy's at Skype, I want to get your application into my network. We've got lot's of people in the business that would benifit.

Here's hoping

Rich

I've disabled file transfer & API in my enterprise using the above method. if the registry key is not there, you will need to create it.

tested with skype version (2.0.0.81). it will prompt me that file transfer is disabled on system.

but there is one question that i hope some light could shine on it. there has always ways to restrict UDP & TCP connections in enterprise. can it be done via registry key or the shared.xml or some innovative ways?

as a network engineer, is there any free tools to obtain the bandwidth usage of skype say between 2 users and 10 users using at the same time?

I have the file transfer and API blocked now. Fantastic.

Can anyone advise how to stop IM, or stop url's in IM

Thanks

Rich

I've finally got file transfer disabled. Reason it wasn't working is because of the version of Skype software.
If you are using skype version 1.4.0.78 thru 1.4.0.84.
Create parameter under the following registry key.
[HKEY_CURRENT_USER\SOFTWARE\policies\Skype\Phone]

"DisableFileTransfer"=dword:00000001
"DisableApi"=dword:00000001

If you are using skype version 2.0.0.81 thru 2.0.0.97.
Create parameter under the following registry key.
[HKEY_LOCAL_MACHINE\SOFTWARE\policies\Skype\Phone]

"DisableFileTransfer"=dword:00000001
"DisableApi"=dword:00000001

Thanks everyone!

Hello everybody...

I need to disable Skype file transfer for only one user in my PC... How can I do this? My Skype version is 2.0.0.81 and if I enter the registry key like [HKEY_LOCAL_MACHINE\SOFTWARE\policies\Skype\Phone]

"DisableFileTransfer"=dword:00000001

IT WORKS. But it works for everyone on that PC and I don't need it to work so... I've tried replacing HKEY_LOCAL_MACHINE with HKEY_CURRENT_USER in that account but it still allowed to transfer the files... Maybe there is other way to disable file transfering for one user without rolling back the skype version to 1.4 or so (i don't remember exactly)... Waiting for any replies...

Ben.

I want to disable skype on my network. The boss is mad because employees are eating all of the bandwidth. Please help

^^^ What kind of bandwidth are you talking about? We're looking at testing Skype, but if lots of clients are using lots of bandwidth, there's no way it's going to fly. The question is, where is the bandwidth usage coming from - actual communication, or clients that are supernodes / relays?

Help needed ...
The client side is always coming up with two checkmarks - one for signing-in when Skype starts and the other for start skype when computer boots ...
How can I make it come up with both checkmarks not checked? It is quite annoying and if I forget to uncheck it, I can not get it to revert to the original settings. It remembers the pwd and then lets anyone who uses the computer to use my Skype id ... not a good idea. So, everytime I miss the checkmarks, i need to blow the Skype away and reload. One of the days I'll have enough and stop after the first step i.e. blow it away ... for ever!
Please help …

mikekarasik - you cannot have it do as you wish for one simple reason: it is skype company policy to FORCE that check box to always be ticked the next time you start skype. See http://skype-news.com/item/?x=539150 Skype uses many such tricks to spread and beat the competition, but those tricks backfire with serious people. We can only hope one day they will respect our wishes and trust us to know what options we want selected.

Is there a Telephone Number we can Contact Skype at?

And what prey tell can I do about my linux users ?

Regkeys ? I don't think so.

Until (take your pick any 1 will do) :

1) The source code is released
2) A clean method of managing the actual traffic is released

I will continue to delete any and ALL installations I find at any of the sites I look after and will advise other IT support workers to do the same.

I will furthermore point out that security through obscurity is no security at all.

If we cannot easily manage Skype communications then how are WE supposed to know when Skype has been hacked ?

Trust you to tell us before it becomes a problem (i.e. before we are hit not after) ?

Wait until a few servers pop their clogs ?

Corporate users have every right to be afraid of traffic they can neither monitor nor control - It is after all OUR networks quit messing with us.

Posted from home (NO SKYPE AT WORK TYVM).

I have the latest version of Skype and setup the "DisableFileTransfer" key, however, I can still transfer files? Can someone post a screenshot in order to validate I setup the reg. keys correctly?

Thanks,

Does anyone know how to disable the API and file transfer in skype version 2.5?

Thanks

It looks like Skype might be about to address some of these issues at last. Lets hope for granular network admin controls and bandwidth monitoring.

Please skype - an anounncement soon.

http://www.infoworld.com/article/06/09/25/HNskypeenterprise_1.html?source=rss&url=http://www.infoworld.com/article/06/09/25/HNskypeenterprise_1.html

Hi my name is Zelmarie and i chat on skype every day but yesterday my littil girl chat to some of my friends and there was this one guy that asked my littil girl for naked foto's of me and my girl is 6 yrs old i need help my girl was in shock laast night i have only his skype name. thank you for the help
My skype name is Zelmarie and my profile is not up to date because of him plz help me

I've skype version 3.6.0.248 and modify above key register doen't work for me.

Any suggests?

using RSS
via Bloglines
using Newsgator
with MyYahoo
with Google
with MyAOL
with netvibes

Admin control of Skype features

Comments

Comment on this post

Recent posts

Archives