Re: Need help with securing a local workstation

From: Steven L Umbach (n9rou_at_nscomcast.net)
Date: 02/15/04 

Date: Sun, 15 Feb 2004 18:31:23 GMT

If the user is a member of just the users group, that will prevent them from
installing "most" software. I suggest you also change the ntfs permissions
on the root/drive folder to give everyone/users no more than
read/list/execute ntfs permissions. Group Policy can help somewhat by
configuring install.exe, setup.exe, etc to the disallowed Windows
application list as decribed in the KB link below. Renaming applications can
bypass that restriction. You may also want to diable the command prompt and
registry editing while you are at it. Be sure to read explaination of any
setting as disabling the command prompt for instance can cause batch files
not to run. To really lockdown applications/installations consider using XP
Pro where the very powerful Software Restriction Policies can use
hash/path/certificate rules to really lock down a computer.
http://support.microsoft.com/default.aspx?scid=kb;en-us;323525
http://support.microsoft.com/default.aspx?scid=kb;en-us;310791

You can use Group Policy/user configuration/administrative templates/windows
components/Windows Explorer to hide and disable drives, but not USB. However
those settings only prohibit a user from using those drives while using
Explorer, My Computer, Network Places, run box etc and will not stop them
from accessing the drive through the command prompt, or other methods
possibly including applications themselves. Depending on your security
requirements you may want to use a computer case that blocks access to those
devices or disconnect the cables on the inside if the case is locked. You
can also disable access to those devices [including USB] via cmos and then
password protect the cmos settings and again be sure the case is locked.
Also be sure to disable cdrom autostart and configure cmos to boot only from
hard drive as it is very trivial to use a boot floppy/cdrom to reset the
local administrator password in less than five minutes. Of course other
security precautions apply such as using complex administrator
asswords. --- Steve MVP Windows Security

"Tim Connolly" <tgaptte@yahoo.com> wrote in message
news:3e181796.0402131051.75e2aded@posting.google.com...
> Hi,
>
> I need to lock down a Windows 2000 Professional SP 2 system so that
> the user cannot do any of the following:
>
> - Access the FDD
> - Access the CDROM
> - Access USB ports
> - Install software
> - And if possible, I'd love to prevent them from running software that
> isn't approved.
>
> Is this possible in the delivered Windows 2000 Professional SP2
> security?
>
> Any suggestions about how to go about this?
>
> Thanks in advance!
>
> Tim

Relevant Pages

  • Re: disable usb devices
    ... PCMCIA/CardBus slots ... Implementing such a system -- say, Windows RMS -- requires a fundamental shift in thinking about the roles and work of information security. ... Blocking USB drives just won't cut it: you'll simply create what I call a "circumvention vulnerability," something that encourages users to look for ways to get around the security policy. ... security threats are you trying to mitigate by disabling USB storage ...
    (microsoft.public.windowsxp.security_admin)
  • NTFS Sharing, Security, and permissions
    ... I have several questions about NTFS permissions and security. ... I have mangled my external drive's Share and Security ... What are the default users and groups setup during Windows ... All hard drives are NTFS. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: User rights in TS 2003
    ... example so how do I lock it down with a policy and still make them able to ... >> You can hide any combination of drives that you want with a Group ... So if your goal is security, ... >> have to use NTFS permissions on the file system as well. ...
    (microsoft.public.windows.terminal_services)
  • Re: SSL 2.0
    ... this is the classic tradeoff between compatibility and security. ... by default from Windows 2000 Server to Windows 2003 Server. ... may look at the instructions for disabling SSL3 and SSL3.5 and say ...
    (microsoft.public.inetserver.iis.security)
  • Re: USB flash drive not recognized
    ... Thank you for contacting SanDisk Technical Support. ... For general troubleshooting of u3 drives, ... Next we would want to try disabling all of your items on "Start-Up". ... Start-Up items are pieces of software that run automatically whenever ...
    (microsoft.public.windowsxp.perform_maintain)