6 Steps to Secure Shared Computers

Kiosks, libraries, Internet cafes, and hotels are just a few of the places you'll find shared Windows computers. Even in the corporate world, many companies offer shared computers in conference rooms or waiting rooms for employees or visitors to use. Securing these computers is a challenge, but the Microsoft Shared Computer Toolkit simplifies the task. The wizards, tools, and scripts included in this free security package make it much easier to properly lock down shared computers. With this toolkit, you can secure a Windows XP Service Pack 2 (SP2) shared computer in six steps.

STEP 1: Set Up the Shared Computer
The Shared Computer Toolkit uses a technology called Windows Disk Protection to reset the Windows partition to a previous known good state every time the computer is restarted. The operating premise is simple: Windows writes any disk changes meant for the primary Windows partition to a separate, hidden partition. When the computer restarts, it loads the original Windows partition and discards the changes in the isolated partition, which effectively restores the computer to the original state.

To use this disk restore technology, the Shared Computer Toolkit requires unallocated drive space behind the primary Windows partition. Thus, if you're installing the toolkit on an existing computer and don't have unallocated space, you need to resize the partition using a third-party tool or rebuild the computer system. Because a shared computer is purpose-built, I recommend building it from scratch and using the Windows setup program to create a primary partition that's slightly smaller than the total capacity of the drive. Size this partition so that you leave at least 1 GB or 10 percent of the size of the primary Windows partition as unallocated drive space.

After you create the partition, finish installing XP and SP2. Log on to the computer using the local Administrator account, and patch the computer with all software updates. Install the programs that you want to make available to the shared computer. For example, if a shared computer will be located in a conference room, you might want to install presentation software such as Microsoft PowerPoint. Avoid installing programs that require individual configurations, such as email programs. That way, you don't need to worry about private account information being left behind between uses.

STEP 2: Set Up the User Account
The next step in using the Shared Computer Toolkit is to set up the user account for the shared computer. The Shared Computer Toolkit works best when users log on with a single shared account. However, you can also use the toolkit to secure a computer accessed by multiple users who log on with individual accounts.

When a user logs on to an XP computer for the first time, Windows creates a user profile that stores configuration settings unique to that user, such as desktop settings, icons, and temporary Internet files. In a shared computer environment in which many people access a computer using a single account, Windows Disk Protection takes care of clearing out this user profile each time the computer restarts. In addition, you can enable a feature that prohibits changes to the profile itself.

If you want user profiles to persist across logons (such as multiple user accounts logging on to the shared computer) and you want to use Windows Disk Protection, you need to create a separate partition outside of the primary Windows partition and configure Windows to store those partitions there. However, I don't recommend this practice. Moving the profiles means they won't be cleaned out. More important, this practice leaves a lot of potentially private information available on a computer destined for shared access, although using an encryption process such as Encrypting File System (EFS) might help. If you need the user profiles to persist across logons, look hard at the goal you're trying to accomplish. Perhaps the Shared Computer Toolkit isn't the best tool to use to meet that goal. Instead, consider locking down the computer using many of the Group Policy Object (GPO) settings that the Shared Computer Toolkit uses but not wiping the data after each use like the Shared Computer Toolkit does.

The Shared Computer Toolkit is designed to work with both standalone and domain member workstations. The steps for locking down a standalone computer versus a domain computer are generally the same, but running the shared computer in a domain requires additional forethought about domain configuration. For example, you need to consider whether you want to enable access to domain resources from the shared computer or whether to use Group Policy for centralized configuration. There are a number of options, depending on your needs:

If you deploy a shared computer in a domain environment, consider using Group Policy to manage some of the shared computer's settings. The toolkit includes an administrative template (sctsettings.adm) that enables many of its lockdown functions to be configured through Group Policy. The toolkit also includes the Shared Computer Toolkit Handbook, which provides useful instructions and discusses in detail some of the caveats when working with the toolkit in a domain environment.

STEP 3: Install the Toolkit
Now it's time to install the Shared Computer Toolkit. You can download the Shared Computer Toolkit from the Microsoft Web site at http://www.microsoft.com/windowsxp/sharedaccess/default.mspx.

When you run the toolkit's setup program (shared_computer_toolkit_enu.msi), a setup wizard will prompt you to download and install the User Profile Hive Cleanup Service. This required service fixes problems caused by users not logging off properly.

By default, the setup program installs the toolkit in the C:Program FilesMicrosoft Shared Computer Toolkit folder. This folder also contains useful documentation and scripts.

STEP 4: Configure the Toolkit
After the Shared Computer Toolkit's installation completes, a program called Getting Started automatically begins. This program walks you through the process of preparing the computer for shared use. At any time, you can exit the program, then restart it by selecting All Programs, Microsoft Shared Computer Toolkit, Getting Started on the Start menu. At the top of the Getting Started program, you'll find icons that let you quickly access many of the toolkit's tools, such as the User Accounts, Profile Manager, User Restrictions, and Disk Management tools.

The Shared Computer Toolkit lets you configure security restrictions at the computer and user levels. Computer-level restrictions include preventing users from creating files and folders on the C drive and removing the Shut Down and Turn Off Computer logon options. You also have the option to stop the local Administrator account from appearing in the Windows Welcome dialog box, but doing so might cause logon problems. For information about these problems, see the sidebar "How to Avoid Getting Locked Out." At the user level, you can configure more than 50 individual features that restrict or lock down the shared user profile.

To show you how to configure the Shared Computer Toolkit, let's assume you want people to use a single shared account to log on to the shared computer. Begin by creating that shared user account on the local computer, naming it Public or something similarly meaningful. Then, launch the toolkit's Get Started program and open the User Accounts tool. Create this account as a Limited account type and not as a Computer Administrator account type. Because it's a shared account, you don't need to create a password for it.

Next, log off as an administrator and log back on to the shared computer using the newly created shared user account. Modify the user profile on the computer to suit your needs. (This step is done directly on the computer and not through the Profile Manager tool or any other Shared Computer Toolkit program.) For example, you can customize the Start menu items and move icons to the Quick Launch toolbar. Run every application that you installed to ensure that it loads properly and runs under the limited account.

After you have created the profile, log off the shared computer and log back on under the Administrator account. Resume the Getting Started program and run the User Restrictions tool.

The User Restrictions tool, which Figure 1 shows, lets you configure more than 50 individual features that restrict or lock down the shared user profile. Click Select a Profile and choose your shared user profile. In the top portion of the tool, you can choose to enable session timers that will log off the user after so many minutes of use or idle time. If you select the Lock this profile check box, the profile becomes locked, preventing any changes. During testing, I recommend that you don't enable the Restart at Logoff option, which restarts the computer after every logoff. Doing so could make it difficult for you to later log on as an administrator.

Next, review the recommended and optional restrictions for shared accounts in the User Restrictions tool and enable those restrictions that suit your environment. For example, you can remove the Control Panel, Printers and Faxes, and Network Connections selections under the Start menu's Settings options. You can remove icons for configuration programs such as the Control Panel or for folders such as My Documents. You can also prevent users from running registry editors, accessing Task Manager, running Microsoft Office macros, and even launching specific programs. Out of the box, the toolkit restricts access to the command-shell window and most other administrative programs, such as the Microsoft Management Console (mmc.exe). Using the default settings is a good starting point, but you'll want to customize the settings to reflect your deployment's needs.

Some of the optional restrictions include preventing Microsoft Internet Explorer (IE) from accessing the Internet, preventing Windows Messenger from starting, and preventing Microsoft Office, Wordpad, or Notepad from running. When you're satisfied with your choices, apply the changes and log out. Log back on to the computer under the shared user account.

STEP 5: Test and Fine-Tune
The first time you log on to the shared computer with all the restricted configurations in place you'll likely be amazed at how locked down Windows can get. Familiar ways of accessing programs are disabled, so you won't be able to manage or configure the profile like you did earlier. There will probably be additional tweaks that you'll want to make to the profile since it was first created.

To fine-tune the profile, log out and log back on under the Administrator account. Resume the Getting Started program, and run the User Restrictions tool. Disable the restrictions to the profile, which might include enabling the Lock this profile option, as Figure 1 shows. It might also include loosening the individual recommended restrictions for shared accounts that you tightened down. Log out, then log back on under the shared user account and edit the profile to suit. When you're completely satisfied with the profile, log out, log back on as an administrator, resume the Getting Started program, and re-enable the user restrictions.

For example, suppose you prohibited users from adding printers, but you want the profile to include a previously configured printer. In this case, you'd need to disable the Prevent users from adding or removing printers restriction, disable the Lock this profile option, log on as the shared user, add the printer, log off and back on as the administrator, run the Shared Computer Toolkit program, then re-enable the restrictions.

STEP 6: Enable Windows Disk Protection
The final step is to enable Windows Disk Protection. In the Getting Started program, click the Windows Disk Protection icon. Enable Windows Disk Protection and specify when Critical Updates should run. By default, the shared computer will run updates everyday at 3:00 A.M. At this time, the computer will automatically disable Windows Disk Protection and execute Microsoft Updates. Optionally, you can configure the toolkit to run an antivirus program or any script you choose. Ten minutes later (or at a duration you specify), the computer will automatically re-enable Windows Disk Protection, thereby keeping any changes made during this update window.

Windows Disk Protection runs computer-wide and resets any and all changes made to the primary Windows partition by shared users and administrators alike. Thus, for example, to change the name of the computer, log on as an administrator and launch the Windows Disk Protection program. Select the Save changes with next restart option, change the computer name, and restart the computer. The change will persist and Windows Disk Protection will re-enable itself after the restart.

A Good Start
Whether you deploy a computer in a true public setting such as a library or just want to harden a conference room PC, the Shared Computer Toolkit will make the job much easier. However, as robust as this toolkit is, using it should just be the starting point for hardening your shared computer. Depending on the computer location and intended usage, you'll want to take other precautions.

For example, if you permit Web browsing from a public terminal, you'll likely want to install Web filtering software. Also, the toolkit hardens the OS from the user perspective but it's still a Windows computer and should be treated like your other systems. Don't forget to install and maintain antivirus and antispyware applications, password-protect the BIOS so users can't change its settings, and use a properly configured firewall to separate your public computers from the Internet. Finally, remember to physically secure your shared computer commensurate to where it will reside. For example, you might want to disable CD-ROM or other external boot devices.