# Presentation: 292521

## PC Manager Meeting

- March 23, 2005

## Today

- Updates
- Next Meeting
- Windows Policy
- Security
- Licenses
- Email
- This Month:
-  Using Admin Rights Only When Needed - Andy Romero (Andy Romero)

## Next Meeting

- April 27th
- Securing IE (Joe Klemencic)

## Windows Policy 

- Next Meeting 4/6, 1:30-2:30, WH5SW
- OU for GPOs
- Kiosk Setup Discussion

## Security

- Security Awareness Day was a success. More brown bags (esp. the user and desktop security courses and Spyware) in the future!
- CST Cookbook
- 'cookbook' section on the security web site.
- Call for short security HowTos
- Example: How to reset XP/2003 local passwords
- Send the doc or link.
- DOE Baselines
- Standard Unix/Linux draft done, with Windows to follow.
- Best for each section to start documenting their standard baseline to be prepared for the future.
- _[CIS](http://pseekits.fnal.gov/PCManagers/CIS/)_ Benchmarks for testing

## Security

- McAfee problem with LHA handling similar to the Symantec UPX handling last month.
*Remember that Nessus is available to sysadmins to scan their systems. Make use of it!*
- Peer review going on right now. Expect changes on the horizon.

## Licenses

- Symantec Visit
- April 14th, 1-2:30pm, WH8XO
- Training
- Reminder! Areas still have training _[days ](http://computing.fnal.gov/pcmanagers/licensing/training/)__available!_

## Email Update

- Anti-Spam
- Better rules
- Web page to report spam

## Main Topic 

- Using Admin Rights Only When Needed
- Andy Romero

## Least Privilege Computing with Windows XP

## Summary

- Least Privilege Computing - Overview
- How to Reduce a User’s Privilege
- Creating an “Admin Shell”
- Dealing With Naughty Applications
- Separate Accounts for Special Tasks

## Least Privilege Computing

- A user should be granted the least privilege level necessary to perform required tasks.

## Least Privilege Computing..why

- Prevents processes, including malware processes, run by a user from damaging the O/S.
- Prevents processes, including malware processes, run by a user from damaging things that belong to other users of the computer (user profiles).
- Is a Proactive measure .... prevents problems from happening
- Uses well designed/tested built-in facilities
- Increased Uptime
- Reduced support calls, rebuilds and security investigations.
- Eliminates meetings

## Least Privilege Computing

- Pure Least Privilege Computing is not practical
- Analyze the user’s set of applications in detail
- Customize every system parameter imaginable so only that set of applications will run.

## Least Privilege Computing

- Practical Least Privilege Computing
- Run Windows XP (SP2)
- Remove General User Accounts from Privileged Groups
- Administrators
- Power Users
- Backup Operators

## What’s Protected

- Operating System Files
- Program Files
- Other Users’ Profiles
- Important Areas of the Registry

## How to reduce a user’s privilege

- Avoid Embarrassment, Make sure you know the Administrator account’s password, also add your workstation support team admins group to the local Administrators group.
- Remove the user from Administrators, Power Users and Backup Operators
- GUI (lusrmgr.msc)
- net localgroup Administrators sparky /delete
- net localgroup PowerUsers sparky /delete
- GPO - Startup Script

## Setting up an “admin shell”

- After you reduce your normal account’s privilege, you need to configure an “admin shell”
- Add your –admin account to your workstation’s local Administrators group
- Log in using your –admin account and do the following
*Double-Click on My Computer*
*Select: Tools-FolderOptions-View*
*Check: Launch Folder Windows In a Separate Process*
*Click: Apply*
*Click: Apply to All Folders*
*Click: OK*
*Log in using your normal account*

## Setting up an “admin shell”

- Create a simple script for launching your admin shell (RunExplorerAsAdmin.bat)runas /user:fermi\%USERNAME%-admin "C:\Windows\explorer.exe“
- Run the script
- Create an Admin_Tools folder and add shortcuts
- Add a background bitmap to your Admin ShellKey: HKCU\Software\Microsoft\Internet Explorer\ToolbarValue: (Regsz) Backbitmap=<path>\<filename>

## Dealing With Naughty Applications

- Some Applications Refuse to Runfor un-privileged users
- worst offenders: http://www.threatcode.com/
- Don’t Freak-Out...a fix is usually possible
- Registry / File-System ACL tweak

## Dealing With Naughty Applications(Helpful Tools)

- _[http://www.sysinternals.com/ntw2k/utilities.shtml](http://www.sysinternals.com/ntw2k/utilities.shtml)_
- Process Explorer
- FileMon
- RegMon

## SummarySimple Rules For Proper Account Usage

- Normal User Accounts
- Should NEVER be members of a privileged group
- Should be used for doing general tasks(e-mail, web-surfing, documenting, debugging ...)
- Admin Accounts
- Are members of the Administrators group
- Should NEVER be used for doing general tasks
- Should NEVER be used to run un-trusted Apps/Installers
*When an admin runs a program, the author of the program, indirectly, becomes an administrator.*

## Separate Accounts for Special Tasks

- Finance Management (banking...etc)
- Why a special acct ?
- General account’s profile may contain dangerous slime
- Characteristics
- non-Admin
- Pre-built User Profile, which can’t be broken (mandatory)
- NEVER use this acct for general computing (e-mail ....)
- Shared Visitor Account
- When...Why
- conference and home systems
- prevent multiple user’s from trashing visitor profile
- Characteristics
- non-Admin
- Pre-built User Profile, which can’t be broken (mandatory)
- Caution
- Warning Banner, “Locally Saved Data Will Self Destruct” !!

## Creating A Mandatory Profile

- Login using the special account
- Configure Applications (IE, Office .... etc)
- Login as Administrator
- ProfileCopy the special account’s profile
- Secure the copied profile
- rename NTUSER.DAT to NTUSER.MAN
- Lockdown the copied profile folder tree
- Set the profile path of the special acct

- fini