desktop lockdown

How is your domain set up?
Is it active directory?
If active directory, you can use Group Policy Objects.

Sounds like you have used Windows Policy Editor in the past, and GPOs are similar. Our organization uses NetIQ Directory and Resource Administrator for administering users & computers. NetIQ has Group Policy Administrator. But I would think Microsoft's Group Policy Manager MMC snap-in would work just as well. I haven't used NetIQ Group Policy Administrator, so I couldn't offer a comparison.

"Nothing Original To Say, So I'll Just Bash Microsoft" Thread...

Just making a starting spot for the 4000 idiot replies about how Microsoft is the worst OS ever and Linux is the savior of Mankind.

On a serious note--Microsoft GPO, particularly with the expanded set offered in 2k3 and the easy interface of GPMC make GPOs very easy and appropriate to use.

I at first simply used software restriction policies and filesystem security. With the software restriction policies set to default:deny and exceptions for 'program files', 'all users'\'start menu', 'all users'\'desktop' and 'windows' folders, while filesystem security denied users the ability to save there. That system effectively limited the computers to run only what was installed on the computer and for any new software would go through me. This effectively kept computers virus free.

The shared computer toolkit does this, but also has helped me keep desktops (background picture, screen resolution, etc) looking as it was the day I installed windows.

Maybe one of these two could help you?

Andrew

I have had some good experiences with AppSense Environment manager. It allows the user desktop to be configured in similar ways to GPO, but has a nice intuitive GUI and can apply setting and controls to none microsoft apps. It also has some nice additional features, such as the ability to "self heal" i.e. ensure a process is always running, or a registry key remains unchanged - both very nice if you get infected by a worm that writes to the run key and kills the AV process.

Try deepfreeze, www.faronics.com. I used it to protect workstations at cybercafes, which are under a barrage of attacks from in and outside. The computer will boot clean every time.
The pro version allows a thawed space but also the limited version can do that, just create a data partition and leave it thawed. Use PowerToys XP to move Documents and Favorites (and possibly some program folders) to the thawed space. There are others but DeepFreeze is the best!! For realtime zero day antivirus protection they have another product which works OK, Anti-Executable, but you have to leave the international settings to USA otherwise it won't accept your admin password. All this works way easier and better and quicker than implementing complex Win security policies.

There are as many resources as there as people to reply.

Personally I use both GPO's and Desktop Authority (ScriptLogic) to manage my domain. There is a snap in for working with AD, Group Policy Management from Microsoft, download it and install it on your PC. It makes things alot easier to manage. As far as streamlining - if you have your AD really nice and clean it should be a snap to configure. If its a mess, then youre going to have problems no matter what you do. Even though we spent almost 7K on Desktop Authority, I still use default Domain policy to lock down all 500 of our PC's excepting IS dept.

Jim Speed
Network Administrator
LCHCS

Take a look at SecureWave. They have both a product that will only allow certain apps to run and can be administered on per user or global basis or anythin in between. True zero day as if you get a virus, it won't be allowed to execute. Let you AV clean it out later when thay have a signature for it. Lock down for I/O is similar, let some one plug in a USB stick and if they are not allowed by the admin, they can't read or write to it. (or be allowed to read only, or write only, or both)

The first steps in Locking down a windows network is removing ADMIN rights from the standard uses and giving them either user or poweruser rights, take a remove-all then add back what they need. It is extrememly easy using XP and 2k3 to do GPO, there is tons of documentation on the web on how to do it. The most important ones are IE policy, and Software restrictions,

In the past, SANS has worked with other organizations (CIS, NSA, etc.) to come up with a very comprehensive template to be applied to 2000 boxes called "the gold standard template". CIS has posted a tool to help you evaluate security as well.

http://www.cisecurity.org/bench_win2000.html

The NSA has also made public templates on how to secure servers and I think the XP os and XP office suite. Search the NSA.gov site if the link is broken

http://www.nsa.gov/snac/downloads_all.cfm?MenuID=scg10.3.1

The NSA templates may be a bit harsh (like not allowing anything to run) so always test it on a separate domain for several weeks before even thinking about putting it on a live production box.

The point is to understand each setting a template makes to the group policy. SANS, as part of the GIAC program, has public papers outlining how to secure various boxes for free reading and download that will go over the meaning of these settings.

http://www.giac.org/certified_professionals/listing/gcwn.php

Check out a solution called Policy Commander from a company called New Boundary technologies. Contains all the Microsoft, NSA NIST templates pre-packed for quick testing and deployment. Also has an editor where you can create your own security policies. Tool will deploy one policy or a group but the neat thing is once you lockdown your PC it will never go out of compliance because the client monitors the configuration you set and, it if gets changed in any way, the client will either alert you or, if you have the automatic function enabled, it will restore the policy with out you or your help desk needing to do a thing.

I've seen Deep Freeze in action.
Very impressive.
You set the computer up just how you want it and
the freeze it.
After that you can install and run anything you
want on the PC until it's turned off.
After you reboot the computer, it goes back to
it's original (frozen) state.
Way too cool.

The only thing close is using a live CD (such as
Knoppix) but I don't know if such a thing exists
for Windows.

I'm currently doing a little due diligence on the many suggestion I rec'd on my post. While doing this I came across another product similar to SecureWare's. It's FullControl from a company called Bardon. Does anyone have any experiences with it?

Thanks for the help.

I use Desktop Authority by ScripLogic.
I it is a suite of products that can be added to for $$$. It does offer remote management and Computer lock downs. One of the features you can add is AD Mmgt.
Thanks