Running as Guest
You can launch your applications to run under the Guest account in several ways. The quickest way is to simply run the Runas command or invoke runas.exe in a batch file. To run the Runas command, right-click the application's icon and select Run as from the menu. (In Windows 2000, you need to hold down the Shift key and right-click.) In the dialog box that's displayed, click The following user radio button and enter the username (Guest) and password you want to use, as Figure 1 shows.
You can also execute Runas at a command line and specify the /save cred parameter to let you save the password so that you don't have to enter it every time. As a rule, using this feature isn't prudent, but because in this case you're using Runas to impersonate the Guest account from an Administrator account, saving the password poses little risk. If someone already has access to your privileged account, they'd have little to gain from running programs as a local Guest.
If you want more features than the built-in Runas command provides, many third-party tools provide them. For example, Wingnut Software (http://www.wingnutsoftware.com) provides a tool called Encrypted RunAs that lets you save account credentials in an encrypted format. Another tool, a freeware utility called SUperior SU (http://www. stefankuhr.de/supsu/main.php3), lets you not only launch a process as another user, but it also switches to a unique desktop for that user, providing even further protection.
The best way to remind users to use the Guest account for security-sensitive activities, such as browsing the Internet, is to replace all the regular desktop and Start menu icons with new icons that launch the applications under the Guest account. That way, users don't have the opportunity to forget to log on as a Guest. On a shortcut's properties, if you click Advanced, you can select the Run with different credentials check box, so that when the user double-clicks a shortcut to start an application, it always prompts for different credentials, as Figure 2 shows. This method requires the user to enter a password each time he or she runs the application, so you might find one of the previously mentioned utilities more convenient to use. These other utilities let you save the user credentials and provide more options for launching the application.
A Partial Solution
Bear in mind that using a Guest account should be only one part of your security strategy. It doesn't completely eliminate security threats; it only minimizes the effects of those threats. Using a Guest account is one implementation of a least-privilege strategy that, as part of a larger security policy, can greatly reduce a user's exposure to attack. For greater security, you should connect user workstations only to trusted networks and use mechanisms such as personal firewalls and antivirus software, antispam software, and antispyware tools to limit network traffic, filter incoming email messages, and block the downloading and installation of malware. Most important, you should actively work to educate users about the risks and techniques for protecting themselves. For more information about the importance of educating users about security, see the Windows IT Pro article "Security Is My Business—and Yours," October 2005, InstantDoc ID 47880.
End of Article
Prev. page
1
[2]
next page -->
