Office applications Toolkit

Alternatives to Windows' standard desktop lockdown features

Tags:
Lockdown,
Hints And Tips,
Security,
Enterprise

Brien M Posey Tech Republic

Published: 28 May 2003 11:35 BST

You clients might want to use desktop lockdown software for a variety of reasons. For example, any time a PC is publicly accessible, they would want to lock down the desktop to prevent anyone from installing unauthorised software. And if they keep sensitive information on PCs in their offices, they should place desktop lockdown software on the PCs to prevent anyone from accessing their files while they're out of the office.

Microsoft has always stood by the claim that security was a major priority in the development of Windows. But sometimes the built-in Windows security mechanisms may not be sufficient. Let's look at several desktop lockdown products that you can suggest to clients to further protect a Windows PC.

Why use desktop lockdown software?
You might be wondering why you should suggest a client spend good money to do something that Windows is already supposed to be able to do. After all, a well-written group policy should prevent anyone from accessing files or modifying the system. However, the sad fact is that it's way too easy to get past the Windows built-in security.

For instance, I have a friend who teaches a high school computer networking class. At first, my friend tried to set up group policies and user accounts in a way that would prevent the students from accessing anything confidential or from modifying the system. However, one day a student loaded a keystroke recorder into the PC. The student then purposefully screwed up something on the system and asked the teacher for assistance. The teacher logged into the machine using the administrator account, fixed the problem, and didn't think anymore about it. The student's keystroke recorder had stolen the administrator password when the teacher logged in. The only reason that the student was caught was that another student reported him.

Desktop lockdown software
With so many tricky ways to get around Windows desktop security, let's take a look at some software that goes beyond the basics.

WINSelect
WINSelect is a desktop lockdown utility that can be installed on Windows 9x, Me, NT 4.0, and 2000. The idea behind WINSelect is that it can disable certain features of the operating system and certain applications, such as Internet Explorer. WINSelect allows you to have 100 percent control over the Web browser and to gain control over things like menus and dialog boxes. You can also disable printing, boot menu options, the Start button, and various desktop icons, such as Network Neighbourhood and My Computer. You can also disable the [Ctrl] and [Alt] keys and the right mouse button. While I think that WINSelect is fine for Windows 9x and Windows Me systems, I would avoid using it on Windows NT and Windows 2000 systems because it is unable to disable the [CTRL][ALT][DELETE] key combination in these operating systems. WINSelect costs around $49 (£30).

Secure PC
Secure PC takes a unique approach to locking down a desktop. Secure PC's philosophy is that most of Microsoft's built-in security mechanisms are good. The problem is that in some versions of the Windows operating system, when you block an operation, the option is simply made unavailable to the user. However, if the user knows how to get around the GUI, the user is often able to perform the "blocked" operation.

Secure PC is designed to take advantage of all of Microsoft's built-in security mechanisms and then build on them by using behind-the-scenes techniques to disable prohibited operations rather than hide them. Secure PC also uses global security mechanisms to individually control access to both files and applications. This allows you to disable any menu option, button, etc. in any application.

Secure PC is an enterprise-class product that supports the creation of various security profiles that can be applied based on a machine's role. The software works on Windows 9x, Me, NT 4.0, 2000, and XP clients, and on Windows NT 4.0, Windows 2000, and Novell NetWare 3.x, 4.x, and 5.x servers. Pricing starts at $99 per license.

Go to section: