Total Win2K lockdown

  • Thread starter Thread starter William Gant
  • Start date Start date
W

William Gant

Hello,
I have two workstations on a small domain-less network in my
apartment. One of them is my primary workstation and can not be
accessed by anyone but me. However, the other one is in the den and is
used by my roommate continually.

Today, I found a significant amount (1+ GB) of porn stored in various
locations on the machine. I also found several programs that he
installed without my permission, expressly for the purpose of file
sharing (MP3s and probably his picture collection). Because there is a
distinct possibility of legal problems and viruses, I have reformatted
and want to absolutely lock the box down where he can't do much on it.
I'd like to lock everything down except solitaire and Microsoft Word.
No web browsing, no personal files (anything he wants to save needs to
be put on a floppy - I want his profile deleted on logoff, if
possible).

I don't want him going out to network neighborhood, or anywhere else.
I want to leave Word accessible in the hopes that he'll have the
opportunity to write a resume, get a job and make something of
himself. I also need Visual Source Safe, MSDE, and IIS to run in the
background as services. I obviously want to lock him out of them, and
I think that's already handled. He can still access the same programs
and his pr0n on his own machine - he's just using mine in case he gets
caught with something he shouldn't have.

I created a special user account for him (it was auto-logging on as
Administrator before because I was stupid enough to be trusting). I
created a group called Buttheads (okay, I called it something a bit
worse than that) and placed him in it. I then added the Deny
permissions for Program Files, Winnt, and other directories that I
don't want him messing with to the Buttheads group. I also want to
disable CTRL+ALT+DELETE and system shutdown from his account (so he
can't mess me up while I'm working in the other room). I want a system
shutdown to require a logon. His account should only be able to logon,
logoff, play solitaire, and run Word (the last two are really optional
at the moment - I want him to have to ask for everything he gets
access to).

Should I use Poledit to finish up the lockdown? If so, how do I apply
the policy?

Thanks,
Will Gant
(e-mail address removed)
 
Run gpedit.msc, then follow this path:

Local Computer Policy / User Configuration / Administrative Templates
/ Start Menu and Taskbar

This will give you a large number of options to play with, e.g.
disable logoff, disable shutdown.

Somebody else will have to tell you how to restrict his
Internet access.
 
Hi Will. You can configure IE to not download files and harden
settings in the tools/internet options/security/internet zone, but not
distinguish between types of files. Using group policy on the computer you
can make those changes in user configuration/admin templates. You would have
to restrict him from being able to change IE settings. Keep in mind by
default that local group policy changes apply to all users - though there
are a couple of hacks that basically use a deny ntfs permission on the group
policy user folder [in winnt\system32], that can be used to exempt
administrator from user configuration. You might want to let him use the
guest account - the profile will not be saved, and configure ntfs
permissions for the root folder to be just read/list/execute for the
everyone group. I do not recommend changing ntfs permissions on the winnt
folder as bad things can happen - non administrators have limited
permissions there anyway. If you want to let him have a place to download
things, then create a folder for him giving him explicit permissions to that
folder and you can use disk quota if you want to limit the amount of room he
can have. To prohibit use of certain applications, use an explicit deny on
the folder or executable file. A personal firewall on the computer with
password protected settings can also limit greatly what he can do by
limiting inbound and outbound access and even controlling access to the
internet by application file that is protected by a md5 hash which can stop
file sharing programs effectively. There are many free ones available. Kerio
and Sygate are excellent. Keep in mind that a lot of what he has downloaded
may still be recoverable. You might want to download something like East -
Tec Eraser to scrub the hard drive including slack space in files and
scramble erased file names - this can be done on an existing operating
system. -- Steve

http://www.webattack.com/Freeware/security/fwfirewall.shtml
http://www.wown.com/j_helmig/w2kdiskq.htm
http://www.east-tec.com/eraser/ -- Free to try.
 
Back
Top