Printable View
I only have limited knowledge about policies, but the blank desktop was merely an example. From what I've been able to deduce, policies and profiles together have the ability to assign very specific controls based on username -- even down to the objects on the desktop. For a guest account, however, I would only recommend a few access points.
The problem with policies is that it's not a security subsystem like that of NT or W2k...
It lies higher in the system and can thus be technically/theorically circumvented.
Policies only limit what the the UI offers to the user... It doesn't control access to ressouces, (memory space, disk access, registry access...).
Example:
As said before, policies can be modified on the fly by modifiying the appropriate regestry keys. To avoid that, you remove regedit.exe from the list of allowed programs in the policies.
Workaround: some kid either -a: renames regedit.exe to an allowed program like mspaint.exe or -b: makes a little piece of code in vb modify the keys...
Result: policies were circumvented, "security" breached...
Policies are good, but can't be trusted by themselves for security. You need to combine that with NTFS and registry permissions (NT/w2k)...
Ammo
Isn't that the point of policies, though? To limit access to vital areas like the DOS shell? This, in combination with the BIOS boot password (making it impossible to boot off a floppy without either knowing the password or cracking open the case to reset the BIOS -- you could also remove the floppy drive from the boot order completely through the BIOS), and you should be able to force the user into the GUI where the objects can be manipulated, restricted, or removed. There wouldn't be access to the shell at all. In such a restricted environment, access to the registry would be near impossible, and renaming files such as regedit.exe would be extremely difficult if there is no way to get to that file (ie, restricted My Computer object and no DOS access). For a bunch of students, I would think this would be an appropriate solution.
I've seen this solution used by many public institutions for their terminals available to the public. Libraries and such often provide only a desktop with a non-modifiable shortcut to the A: drive and perhaps a shortcut to Internet Explorer, and maybe the printer. They then can lock off access to the harddrives except for one folder -- the desktop. You can save information to the desktop or the A: drive, and that's it. You can even deny the ability to save at all.
well, just to provide a bit of counter-point: to get a bios password one could use a hardware key-logger(yes, they actually exist: they look like a small patch cord for the keyboard and have enough memory onboard to hold quite a few key strokes if they work as advertised(something i cant attest to)). from there the entire security scheme is broken.Quote:
Originally posted here by roswell1329
Isn't that the point of policies, though? To limit access to vital areas like the DOS shell? This, in combination with the BIOS boot password (making it impossible to boot off a floppy without either knowing the password or cracking open the case to reset the BIOS -- you could also remove the floppy drive from the boot order completely through the BIOS), and you should be able to force the user into the GUI where the objects can be manipulated, restricted, or removed.
you would be surprised at the lengths "a bunch of students" will go to to impress their geek friends(belive me, i know from experiance).Quote:
For a bunch of students, I would think this would be an appropriate solution.
well, i agree that techniques similar to this are often used, but most of the time they can be broken fairly quickly by a dedicated individual.Quote:
I've seen this solution used by many public institutions for their terminals available to the public. Libraries and such often provide only a desktop with a non-modifiable shortcut to the A: drive and perhaps a shortcut to Internet Explorer, and maybe the printer. They then can lock off access to the harddrives except for one folder -- the desktop. You can save information to the desktop or the A: drive, and that's it. You can even deny the ability to save at all.
.Quote:
well, just to provide a bit of counter-point: to get a bios password one could use a hardware key-logger(yes, they actually exist: they look like a small patch cord for the keyboard and have enough memory onboard to hold quite a few key strokes if they work as advertised(something i cant attest to)). from there the entire security scheme is broken.
Yeah, I knew about those. In fact ThinkGeek has one: http://www.thinkgeek.com/stuff/gadgets/5a05.shtml
However, once the BIOS password is captured, almost any Windows 9x security is lost because of the ability to boot off a floppy. Even Windows NT/2K/XP is vulnerable to password modification through the floppy drive. :bigsmile:
In this case, it appears that the main goal of security is to provide a system of protection that is just beyond what the system/data is worth to protect, to keep out only those most dedicated to messing things up. (Let's hope someone would notice someone installing a keygrabber) If you go balls-to-the-wall with security, you limit the convenience of the users and costs of implementation and maintainence go up. If this school was maintaining national security secrets on their systems, I would recommend they speak with the NSA, but since we're talking about school computers I wanted to keep it simple. Profiles and Policies are built-in to Windows, so their cost is minimal, and they provide a fairly robust alternative to FoolProof which apparently isn't working. No sense getting another high-profile commercial product (whose exploits are usually publically available about 30 minutes after the product hits the shelves), that will eventually be defeated anyway.