• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Locking down work computers

B

BinarySynapse

[H]F Junkie
2FA
Joined
Feb 6, 2006
Messages
13,965
The two computers where I work are completely unsecured (the only user account is administrator account with no password). Because of that, one of them had become severely infected with keyloggers, screen capturers, backdoors, root-kits. Mind you this is a computer that is used to handle customer information (including CC#'s).


So yesterday, my manager, the owner, and I discussed what needed to be done to secure the system so this can't happend again. I told them it needs to be running Windows 7 (it's licensed for it, but they had XP on it), all employees need their own limited accounts, and they need to be locked down so that only the programs and websites absolutely needed to do business can be accessed....


... so since I brought it up, I get to take care of all that.... how do I do it? I've been looking through policy settings, but everything I try seems to have unintended consequences (e.g. "block all programs except" applies to the admin account, and causes the allowed programs to not function properly)..
 
Last edited:
What you are talking about can be done using a variety of techniques. Limited accounts and policy settings work well for Microsoft software, but few third party applications actually follow Microsoft's development guidelines and therefore cause issues when used with restricted accounts. File and registry permissions settings for applications solves this problem but it takes a lot of trial and error testing on your part to accomplish them. Another option is a program called Deep Freeze. You create an area on the system which allows for data to be written. Then after everything is installed and the application is enabled, you can simply restart the computer to clear out anything. Installed programs, viruses, trojans, key loggers, etc. The system saves literally nothing outside of what it calls "thawspace."

With that you can even leave all the accounts as admin accounts and you won't have any issues. Just keep the password to Deep Freeze secured as it will be required to disable the program for software updates and installations of valid and authorized applications. It can also have a maintenence time set for AV updating and system patching. Which I'd use WSUS for patching if you aren't already. It's free and not too hard to implement.
 
Thanks Dan.

Does the Deep Freeze license allow for commercial use? Does it protect the system between reboots? These computer can stay up for days at a time, so if a virus gets on there, will it be able to do as it pleases before getting flushed? (though I guess it could be forced to restart during shortly after shift changes.
 
Dan_D said:
What you are talking about can be done using a variety of techniques. Limited accounts and policy settings work well for Microsoft software, but few third party applications actually follow Microsoft's development guidelines and therefore cause issues when used with restricted accounts. File and registry permissions settings for applications solves this problem but it takes a lot of trial and error testing on your part to accomplish them. Another option is a program called Deep Freeze. You create an area on the system which allows for data to be written. Then after everything is installed and the application is enabled, you can simply restart the computer to clear out anything. Installed programs, viruses, trojans, key loggers, etc. The system saves literally nothing outside of what it calls "thawspace."

With that you can even leave all the accounts as admin accounts and you won't have any issues. Just keep the password to Deep Freeze secured as it will be required to disable the program for software updates and installations of valid and authorized applications. It can also have a maintenence time set for AV updating and system patching. Which I'd use WSUS for patching if you aren't already. It's free and not too hard to implement.
Click to expand...
I'd recommend going through the trial and error of finding the correct file and registry permissions. Deep freeze is nice, but it still allows malware to run. It just makes cleanup a breeze.

I'd set up the workstations with only the apps they need, with only the permissions they need. Allowing specific websites is a bit more problematic, but there are always options depending on how many sites we're talking about.
 
XOR != OR said:
I'd recommend going through the trial and error of finding the correct file and registry permissions. Deep freeze is nice, but it still allows malware to run. It just makes cleanup a breeze.

I'd set up the workstations with only the apps they need, with only the permissions they need. Allowing specific websites is a bit more problematic, but there are always options depending on how many sites we're talking about.
Click to expand...

It really depends on the applications needed and how many there are. When you've got 40 applications on a machine like a computer animation workstation, it's a huge pain. And when I had to take such things into consideration I did all of the above I mentioned. Locked down group policy's, permissions, and Deep Freeze.
 
All we need is IE, Word/Excel, and adobe reader. All our work is done through an online app, and print-outs sent back in PDF files-


There are other little things that the managment needs to do, but I can allow for that since they're tiny applications.


I was looking at Deep Freeze and saw they have a program called WINSelect that seems to do exactly what I need to do. Anyone have any experience wih ti?
 
Dan_D said:
It really depends on the applications needed and how many there are. When you've got 40 applications on a machine like a computer animation workstation, it's a huge pain. And when I had to take such things into consideration I did all of the above I mentioned. Locked down group policy's, permissions, and Deep Freeze.
Click to expand...
When you are dealing with CC #s, you don't really want to take chances by letting users run as administrators.

I know it can be a pain, certainly. I especially like the applications I've found that, for whatever reason, need write access to the joystick port setting in the registry ( HKLM. Presumably it was from a vestigial copy prevention technology ). But if the choice is between fiddling with a computer for a week to get permissions right, or exposing my customer CC data to malware..well, it's not much of a question, is it?

OP, if you are going to do it, do it right. The upshot of this is that you won't need Deep Freeze. Even if a user gets infected with something, you just nuke their profile and your done.
 
Windows XP + Steady State. The machine runs full steady state lock-down and is set up to auto log in with a domain account that has absolutely no privileges.

No need to reinvent the wheel here. Steady state works great and it is free. I use this combo on all the internet kiosks in my complex. Have not had a single virus in almost 5 years on any of them.
 
I'm assuming that Anti-Virus is already in place...
ScriptLogic has a solution that allows you to still run limited accounts, but elevate anything you have OK'd:
http://www.scriptlogic.com/products/privilegeauthority/

So you can essentially say, "Block everything from running as Admin, except for these few apps that need it".
You can quite effectively eliminate malware from even running there to start with, or at least greatly reduce the possibility of it.
Sure, users can download malware (A web filter would stop THAT part of it): but it won't be able to run as Admin. They can trash their profile, but not the PC.

Looking at deploying this myself.
 
The franchiser supplies a disc image with the software for us to use on our systems which includes Windows XP Pro (set up the way that allowed this mess to happen) and Symantec Enpoint Protection 11. However, we don't HAVE to use their software since we use their online application to process transactions. Since the systems are licensed for 7 Pro, I went and ahead and put that on the one I worked on last night.

Unfortunately, the version of SEP they give us is not compatible with 7, and we don't have the serial number to get on File Connect to get the patch that fixes it We really want to stick with 7 if we can, so I installed MSE in the mean time. So yes, there's anitivirus in place, but it may not be the best option for our environment..

That said, the ScriptLogic thing doesn't really look like the direction we want to go with this. Ideally, we don't want ANY program running at all except those we absolutely have to have to do our jobs. No freecell, no paint, no µTorrent (which actually was on this system). We want only a select few websites we need access to. And we want to block every file from being downloaded except for the reports and receipts we have to print off (pdf files).

BTW, everything I do get's the owner's approval before I do it. (eg. he nixed the idea that each employee have their own user account, which makes sense since we already have to use our own login info for the website we use).
 
I wonder why people don't use mandatory profiles and edited local policies more? You can lock down any Windows machine. You can have it where the only thing that a user sees or can use is notepad when they login.

For our public computers, I just setup the account and change the ntuser.dat to .man and then use Group Policy for the rest.
 
Elvis u have links to guides on this? i tried this but could not get it all figured out.
 
schnell said:
Windows XP + Steady State. The machine runs full steady state lock-down and is set up to auto log in with a domain account that has absolutely no privileges.

No need to reinvent the wheel here. Steady state works great and it is free. I use this combo on all the internet kiosks in my complex. Have not had a single virus in almost 5 years on any of them.
Click to expand...

This. Although Microsoft no longer supports Steady State (won't work on 7, works on XP and I think Vista) and they've removed the download link in their download library. I'm sure if you Google it, you'll find a working link.
 
ryan_975 said:
That said, the ScriptLogic thing doesn't really look like the direction we want to go with this. Ideally, we don't want ANY program running at all except those we absolutely have to have to do our jobs.
Click to expand...
And that's exactly what ScriptLogic allows you to do, lol.

Regardless, it sounds like all your stuff is web-based? Give them limited accounts then, and be done with it. You're looking for a web filtering solution.
The best way to do this (with NO software on the PCs)... Is Untangle: http://www.untangle.com/

I've put that into some small offices before and it works great. Just find an old PC (look at the specs, you don't need anything except maybe buying a second NIC), and run it headless. Firewall, web filtering, spam filtering, you name it. Now I do notice they have changed the pricing structure a bit (used to be 100% free)- but check it out anyway, they still have a free version.

ElvisG said:
For our public computers, I just setup the account and change the ntuser.dat to .man and then use Group Policy for the rest.
Click to expand...
This is also a good suggestion that'd prevent them from changing anything in the profile, especially since all the work is supposed to be done in the browser.
You can also create policies that would just auto-launch the browser and not let them do anything else.
 
Looks like SteadyState is downloadable from CNET

http://download.cnet.com/Windows-SteadyState/3000-18512_4-11127965.html

Took like 30 seconds to find btw.

If you have a domain setup with Active Directory, you can use Scriptlogic Privilege Authority.

It will allow you to completely lock down the system and then specifically give permissions to run only the programs you want to allow. You can lso choose exactly what permissions you want to give those programs.

The "Community Edition" is free for personal and business use and works great.

If you need the xtra do-dads of the professional edition, it is something like $10 or $12 per seat last time I checked.

Deep Freeze is a piece of trash. I have had the absolute displeasure of having to work on a computer that was using it. To do any updates or install/remove software, you first have to un-freeze, reboot, do your stuff, then re-freeze and reboot again.

Stuff like using thumb drives also doesn't work with a computer with Deep Freeze installed on it until you unfreeze and reboot. This can be good and also very bad, especially if it is a system that is used for a hotel office where people will have there documents on a thumb drive... Such a stupid piece of software.

Any software that does the same type of thing just needs to die and never come back without some serious ground-up re-design.

edit:
MS still appears to have the SteadyState documentation available for download.
http://www.microsoft.com/en-us/download/details.aspx?id=4310
 
Last edited:
Notice: He posted Ready state, not steady state, hence why I didnt find it.
 
Another one to look at would be a program called Drive vaccine that works pretty good. Also a free version I know of is reboot restore rx just google it.
 
This is 2013 folks.

Limited accounts, no java, no flash, disable the user from turning off IE protected mode. Use a decent AV and you should have 90% of the main issues covered.

If you want to lock it down even more consider using something like PDFexchange instead of Adobe Acrobat.

Run http://secunia.com/vulnerability_scanning/personal/ on the machine before locking it down using any of the methods suggested on here.
 
See princess bride....


Nah nah nah ...what do you know....this thread is only MOSTLY DEAD...
 
You must log in or register to reply here.
Back
Top