SQL Server Magazine

Kiosks, libraries, Internet cafes, and hotels are just a few of the places you'll find shared Windows computers. Even in the corporate world, many companies offer shared computers in conference rooms or waiting rooms for employees or visitors to use. Securing these computers is a challenge, but the Microsoft Shared Computer Toolkit simplifies the task. The wizards, tools, and scripts included in this free security package make it much easier to properly lock down shared computers. With this toolkit, you can secure a Windows XP Service Pack 2 (SP2) shared computer in six steps.

STEP 1: Set Up the Shared Computer
The Shared Computer Toolkit uses a technology called Windows Disk Protection to reset the Windows partition to a previous known good state every time the computer is restarted. The operating premise is simple: Windows writes any disk changes meant for the primary Windows partition to a separate, hidden partition. When the computer restarts, it loads the original Windows partition and discards the changes in the isolated partition, which effectively restores the computer to the original state.

To use this disk restore technology, the Shared Computer Toolkit requires unallocated drive space behind the primary Windows partition. Thus, if you're installing the toolkit on an existing computer and don't have unallocated space, you need to resize the partition using a third-party tool or rebuild the computer system. Because a shared computer is purpose-built, I recommend building it from scratch and using the Windows setup program to create a primary partition that's slightly smaller than the total capacity of the drive. Size this partition so that you leave at least 1 GB or 10 percent of the size of the primary Windows partition as unallocated drive space.

After you create the partition, finish installing XP and SP2. Log on to the computer using the local Administrator account, and patch the computer with all software updates. Install the programs that you want to make available to the shared computer. For example, if a shared computer will be located in a conference room, you might want to install presentation software such as Microsoft PowerPoint. Avoid installing programs that require individual configurations, such as email programs. That way, you don't need to worry about private account information being left behind between uses.

STEP 2: Set Up the User Account
The next step in using the Shared Computer Toolkit is to set up the user account for the shared computer. The Shared Computer Toolkit works best when users log on with a single shared account. However, you can also use the toolkit to secure a computer accessed by multiple users who log on with individual accounts.

When a user logs on to an XP computer for the first time, Windows creates a user profile that stores configuration settings unique to that user, such as desktop settings, icons, and temporary Internet files. In a shared computer environment in which many people access a computer using a single account, Windows Disk Protection takes care of clearing out this user profile each time the computer restarts. In addition, you can enable a feature that prohibits changes to the profile itself.

If you want user profiles to persist across logons (such as multiple user accounts logging on to the shared computer) and you want to use Windows Disk Protection, you need to create a separate partition outside of the primary Windows partition and configure Windows to store those partitions there. However, I don't recommend this practice. Moving the profiles means they won't be cleaned out. More important, this practice leaves a lot of potentially private information available on a computer destined for shared access, although using an encryption process such as Encrypting File System (EFS) might help. If you need the user profiles to persist across logons, look hard at the goal you're trying to accomplish. Perhaps the Shared Computer Toolkit isn't the best tool to use to meet that goal. Instead, consider locking down the computer using many of the Group Policy Object (GPO) settings that the Shared Computer Toolkit uses but not wiping the data after each use like the Shared Computer Toolkit does.

The Shared Computer Toolkit is designed to work with both standalone and domain member workstations. The steps for locking down a standalone computer versus a domain computer are generally the same, but running the shared computer in a domain requires additional forethought about domain configuration. For example, you need to consider whether you want to enable access to domain resources from the shared computer or whether to use Group Policy for centralized configuration. There are a number of options, depending on your needs:

• You can use a shared local account and require that users bring external documents on an external device, such as a USB drive or CD-ROM.
• You can use a shared local account but let the users browse and authenticate to network resources using their domain credentials. To do so, you need to disable the ability to cache credentials.
• You can add a hard disk and reconfigure the user profiles to that partition. Windows Disk Protection manages only the primary Windows partition; data on all other partitions will persist. If you need only a few accounts, you can use the toolkit's Profile Manager tool to create a new profile on an alternate partition.
• You can redirect the My Documents folder to a network share. That way, if someone saves a document in the shared computer's My Documents folder, the file will be saved on the network.

If you deploy a shared computer in a domain environment, consider using Group Policy to manage some of the shared computer's settings. The toolkit includes an administrative template (sctsettings.adm) that enables many of its lockdown functions to be configured through Group Policy. The toolkit also includes the Shared Computer Toolkit Handbook, which provides useful instructions and discusses in detail some of the caveats when working with the toolkit in a domain environment.

   Prev. page   [1] 2     next page