Securing Windows

[Kimm]

I have one for you, I read an article that said you could set up a computer with policy editor to have users but make it look like there's only one user. The reason for this,according to the article, is to fool a reasonably knowledgable person that shares your computer into thinking there is no policies to be curious about. So certain files are removed. How would I know what files are suppose to be on the computer, or what reg. key should be there if there were only one user. Our computer has been set up to bypass the logon to Windows, I think you have to set up a user for that don't you?

[RWSchlatter]

Hi - well curious is human nature.
But when things are locked down on a Win9x/ME machine, just be sure that policies deny access to management tools like REGEDIT and POLEDIT. Possibly put them also on the list of programs that may not be started by the user, or if necessary, remove the .EXEs from the machine and keep either on floppy and/or network share for admin use only. It depends also how your computer is used, maybe you can set up policies to run only programs contained on a permission list. But otherwise it is a bit tricky to inhibit a knowlegable user from running freeware / shareware that accesses the registry on these O/Ss . Problem too, that scripting WSH will also have access to the registry if active on your computer.

______________
Regards - Richard

[Kimm]

Thanks Richard, not sure if I know what WHS is but I'll look it up. Wonder how I can get "computer Illiterate" put under my name in these postings instead of visitor. Take care Kim

[RWSchlatter]

Hi - WSH (not WHS, sorry) is the Windows Scripting Host. If J am not mistaken, it gets automatically installed with IE55. Older systems that do not upgrade, or don't download it separatly, will not have it.

What is it: a interpreted programming environment, designed to let you easily perform maintenance work on a computer. As such its intent is to replace .BAT and .CMD files, cause it is more flexible and integrates better with the OS.

But cause it is a programming language with access to API you can do all nasty things with it too, that is where security concerns come in.

WSH will mainly accept following two languages: JScript and VBScript. JScript has nothing to do with Java as the "J" may suggest, but the coding style is C/C++ like, while VBScript of course will be familiar to all Visual Basic coders. Both scripting languages can also be used for Web Page Scripting.

Microsoft information / online documentation at:
<a target="_blank" href=http://msdn.microsoft.com/scripting/>http://msdn.microsoft.com/scripting/</a>

______________
Regards - Richard

[Simon Clausen]

Stay tuned for the Windows Scripting Guide http://www.winguides.com/ (http://scripting.winguides.com/>http://scripting.winguides.com/</a>)

[Kimm]

Thanks Simon, I'll be sure to keep an eye out for it.