Book Image

Least Privilege Security for Windows 7, Vista and XP

By : Russell Smith
Book Image

Least Privilege Security for Windows 7, Vista and XP

By: Russell Smith

Overview of this book

Least Privilege Security is the practice of assigning users and programs the minimum permissions required to complete a given task. Implementing this principle in different versions of Microsoft Windows requires careful planning and a good understanding of Windows security. While there are benefits in implementing Least Privilege Security on the desktop, there are many technical challenges that you will face when restricting privileges.This book contains detailed step-by-step instructions for implementing Least Privilege Security on the desktop for different versions of Windows and related management technologies. It will provide you with quick solutions for common technical challenges, Microsoft best practice advice, and techniques for managing Least Privilege on the desktop along with details on the impact of Least Privilege Security.The book begins by showing you how to apply Least Privilege Security to different categories of users. You will then prepare a desktop image with Least Privilege Security enabled from the start and deploy the new image while preserving users' files and settings. You will identify problems with applications caused by Least Privilege Security using the Application Compatibility Toolkit. This book will help you configure User Account Control on multiple computers using Group Policy and support Least Privilege user accounts using reliable remote access. Then, you will modify legacy applications for Least Privilege Security, achieving the best balance between compatibility and security by using Application Compatibility shims. You will install per-machine ActiveX Controls using the ActiveX Installer Service (AxIS). The book will help you implement best practices for working with ActiveX Controls in a managed environment. Finally, you will deploy default Software Restriction Policy (SRP) or AppLocker rules to ensure only programs installed in protected locations can run and blacklist applications using SRP or AppLocker.

Related Content you might be interested in

Current Title:

Small book image
Least Privilege Security for Windows 7, Vista and XP
Russell Smith
Jul, 2010 | 464 pages
No titles found
Table of Contents (19 chapters)
Least Privilege Security for Windows 7, Vista and XP
Least Privilege Security for Windows 7, Vista and XP
Credits
Credits
About the Author
About the Author
About the Reviewers
About the Reviewers
Preface
Preface
Free Chapter
1
An Overview of Least Privilege Security in Microsoft Windows
An Overview of Least Privilege Security in Microsoft Windows
What is privilege?
What is Least Privilege Security?
Least Privilege Security in Windows
Advanced Least Privilege Security concepts
Least Privilege Security in the real world
Benefits of Least Privilege Security on the desktop
What problems does Least Privilege Security not solve?
Common challenges of Least Privilege Security on the desktop
Least Privilege and your organization's bottom line
Summary
2
Political and Cultural Challenges for Least Privilege Security
Political and Cultural Challenges for Least Privilege Security
Company culture
Getting support from management
User acceptance
Applying Least Privilege Security throughout the enterprise
Managing expectations
Maintaining flexibility
User education
Summary
3
Solving Least Privilege Problems with the Application Compatibility Toolkit
Solving Least Privilege Problems with the Application Compatibility Toolkit
Quick compatibility fixes using the Program Compatibility Wizard
Achieving application compatibility in enterprise environments
Summary
4
User Account Control
User Account Control
User Account Control components
The shield icon
User Account Control access token model
Conveniently elevating to admin privileges
Summary
5
Tools and Techniques for Solving Least Privilege Security Problems
Tools and Techniques for Solving Least Privilege Security Problems
Granting temporary administrative privileges
Bypassing user account control for selected operations
Configuring applications to run with elevated privileges on-the-fly
Solving LUA problems with Avecto Privilege Guard
Suppressing unwanted User Account Control prompts
Setting permissions on files and registry keys
Fixing problems with the HKey Classes Root registry hive
Mapping .ini files to the registry
Using LUA Buglight to identify file and registry access violations
Summary
6
Software Distribution using Group Policy
Software Distribution using Group Policy
Installing software using Group Policy
Summary
7
Managing Internet Explorer Add-ons
Managing Internet Explorer Add-ons
ActiveX controls
Managing add-ons
Summary
8
Supporting Users Running with Least Privilege
Supporting Users Running with Least Privilege
Providing support
Troubleshooting using remote access
Enabling and using command-line remote access tools
Enabling and using graphical remote access tools
Configuring Windows Firewall to allow remote access
Summary
9
Deploying Software Restriction Policies and AppLocker
Deploying Software Restriction Policies and AppLocker
Controlling applications
Implementing Software Restriction Policy
AppLocker
Summary
10
Least Privilege in Windows XP
Least Privilege in Windows XP
Installing Windows XP using the Microsoft Deployment Toolkit
Windows XP security model
CD burning
ActiveX controls
Changing the system time and time zone
Power management
Managing network configuration
Identifying LUA problems using Standard User Analyzer
Summary
11
Preparing Vista and Windows 7 for Least Privilege Security
Preparing Vista and Windows 7 for Least Privilege Security
The Application Compatibility Toolkit
Creating a Data Collection Package
Printers and Least Privilege Security
Logon scripts
Why do a desktop refresh from a technical perspective?
Different methods of reinstalling Windows
Reinstall Vista or Windows 7 with Least Privilege Security
Summary
12
Provisioning Applications on Secure Desktops with Remote Desktop Services
Provisioning Applications on Secure Desktops with Remote Desktop Services
Introducing Remote Desktop Services
Summary
13
Balancing Flexibility and Security with Application Virtualization
Balancing Flexibility and Security with Application Virtualization
Microsoft Application Virtualization 4.5 SP1 for Windows desktops
VMware ThinApp
Summary
14
Deploying XP Mode VMs with MED-V
Deploying XP Mode VMs with MED-V
Solving least privilege security problems using virtual machines
Microsoft Enterprise Desktop Virtualization (MED-V)
Summary

Summary

We should now have a full understanding of the principle of Least Privilege Security and its implementation in Windows, from the early days of no real security in consumer editions of the operation system to today's push towards Least Privilege Security in Windows 7. Before proceeding to the next chapter, we have:

  • Understood how system privileges are used to control the aspects of an operating system's configuration that users can change

  • Familiarized ourselves with the principle of Least Privilege Security, and how it is implemented in different versions of Microsoft Windows

  • Become aware of the technical advantages and disadvantages that Least Privilege Security brings to desktop computing

  • Understood the business benefits of Least Privilege Security on the desktop

In the next chapter, we will move on temporarily from the technical aspects of implementing Least Privilege Security on the desktop, to talk about the cultural and political challenges, which for many can be harder to overcome.

Previous Section
End of Chapter 1
Next Chapter