Skip to main content

Lock down Synergy settings so users cannot change them

Updated

Product: Synergy 1 Business Team (1.18 and above)
Operating system: Windows, macOS, and Linux

Note - this is a Synergy 1 Business Team feature

How locked settings work

Synergy 1 can enforce a fixed value for certain settings so that the people using a computer cannot change them. You do this by placing a file named Synergy.locked.ini in the system-wide settings folder. On every launch, Synergy reads that file, applies each setting it contains, and grays out the matching control in the settings window. If a user changes the setting in their own profile, the locked value is applied again the next time Synergy starts.

Two things to keep in mind:

  • A setting is locked because its key is present in the file, whatever the value. Only include the keys you want to enforce.
  • The locked file is a policy control for standard users. A local administrator can still edit or delete it.

The locked file is not the text-based server configuration file (the .conf file that describes your screen layout). That file is covered in: Creating and using text config files

Where the file goes

  • Windows: C:\ProgramData\Synergy\Synergy.locked.ini
  • macOS and Linux: /etc/xdg/Synergy/Synergy.locked.ini

Create the folder if it does not exist. On Linux the file name is case-sensitive.

Settings you can lock

Setting Section Key Value
Require TLS encryption [General] cryptoEnabled true or false
TLS certificate path [General] tlsCertPath As written in Synergy.ini
TLS key length [General] tlsKeyLength As written in Synergy.ini
Clipboard sharing [internalConfig] clipboardSharing true or false
Clipboard sharing size limit [internalConfig] clipboardSharingSize As written in Synergy.ini

The locked file uses the same keys and values as Synergy.ini, the file Synergy saves its settings to. To find the right value for any key, set it in the GUI on a reference machine and copy the line from that machine's Synergy.ini.

Example file

This file requires TLS and turns clipboard sharing off:

[General]
cryptoEnabled=true

[internalConfig]
clipboardSharing=false

File format rules

  • The [internalConfig] header is required for the clipboard keys. The [General] header is optional (keys placed before any header are read the same way), but include it for clarity.
  • For on/off settings use true or false (1 and 0 also work). Do not use no, off, or disabled: Synergy reads these as true, which leaves the setting enabled without any warning.
  • Save the file as UTF-8. A byte order mark and Windows line endings are both fine, so Notepad's defaults work.

Two-machine setups

Clipboard sharing is a server setting: Synergy writes it into the server configuration it generates at startup, and the client follows the server. Deploy the same locked file to every machine so the lock applies whichever computer is acting as the server.

Deploying the file

Windows

Windows lets any standard user create files and folders under C:\ProgramData, and whoever creates something there becomes its owner with full control. So if a standard user launches Synergy before C:\ProgramData\Synergy exists, that user owns the folder and can edit or delete the locked file. Create the folder and the file from your deployment tool (Intune, SCCM, and GPO startup scripts all run as SYSTEM) or from an administrator account, before Synergy is installed or first launched.

To harden the folder, create it explicitly, disable inheritance, and grant full control to SYSTEM and Administrators and read and execute to Users, with no CREATOR OWNER entry. Set the same on the file itself. In your deployment step, after writing the file:

icacls "C:\ProgramData\Synergy" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"
icacls "C:\ProgramData\Synergy\Synergy.locked.ini" /inheritance:r /grant:r "SYSTEM:F" "Administrators:F" "Users:RX"

This assumes the default "Current user" settings profile, where Synergy keeps everything else in each user's own profile folder and C:\ProgramData\Synergy holds only the locked file. With the "All users" settings profile, Synergy writes its shared Synergy.ini, the server configuration it regenerates on every server start, and the TLS certificate and fingerprint files into that same folder, so standard users need to be able to create and write files there. In that case, leave the folder's permissions alone and run only the second command, on the locked file itself. The profiles are described in: Configure Synergy for multi-user support

On a machine where the folder already exists, check who owns it and what standard users can do:

icacls "C:\ProgramData\Synergy"
icacls "C:\ProgramData\Synergy\Synergy.locked.ini"

Users should show (RX) or (R) only, with (F) for SYSTEM and Administrators. If a user account shows (F) or (M), that user created the folder. Take ownership as an administrator, then run the hardening commands above:

takeown /f "C:\ProgramData\Synergy" /r /d y

Fleet-wide deployment steps are in: Synergy Business Silent & Automated Deployment (Windows)

macOS and Linux

The locked file on macOS and Linux has been verified by our developers but has not yet been used in a customer deployment. It is expected to work exactly as on Windows; if it does not, please contact our business support team

/etc/xdg is owned by root, so a standard user cannot change files in it. Create the folder and file as root:

sudo mkdir -p /etc/xdg/Synergy
sudo tee /etc/xdg/Synergy/Synergy.locked.ini > /dev/null <<'EOF'
[General]
cryptoEnabled=true

[internalConfig]
clipboardSharing=false
EOF
sudo chmod 644 /etc/xdg/Synergy/Synergy.locked.ini

Checking that the lock is applied

Start Synergy and open the settings window. A locked setting is grayed out: TLS in the main settings, clipboard sharing in the server settings.

  • If the control is still editable, Synergy did not read the file. Check that it is at the path above, named exactly Synergy.locked.ini, and that the clipboard keys sit under an [internalConfig] header.
  • If the control is grayed out but shows the wrong value, check the value. Anything other than true, false, 1, or 0 is read as true.

Related articles