Securing a High School Windows XP Computer Lab? 533
An anonymous reader asks: "My SO just inherited a computer lab from a departed teacher who was no security guru. These are Windows XP systems, and security basically consists of a password on the admin account, a subscription to McAfee Security Center, and a free Internet filter. The students have access through a non-passworded 'limited' user account that doesn't seem to limit much. They have been going in and changing settings, downloading games and music, and generally screwing the computers up during class time, in many cases leaving them unusable. As the geek in our house, she has asked me to give her a hand, but while I have dealt with some security issues in the past, it was to protect against remote intruders, not against someone who has to have access to the keyboard. Any suggestions on the best way to lock these systems down?"
Policy Editor (Score:1, Informative)
Check out the microsoft shared computer toolkit (Score:5, Informative)
Is a good place to start for newbies. Or if these are XP pro machines you can use gpedit.msc (start->run->gpedit.msc)
If these are XP home machines try this http://www.dougknox.com/xp/tips/xp_home_sectab.ht
deep freeze (Score:5, Informative)
Please note i'm not associated with faronics or deep freeze in any way, just found the program useful and thought it might help you out.
Get a domain controller and follow these policies (Score:4, Informative)
This is the only way I've found to keep people from messing up Windows Machines.
Re:deep freeze (Score:2, Informative)
Shared Computer Toolkit WDP (Score:3, Informative)
Deep Freeze (Score:2, Informative)
Deep Freeze a great solution (Score:5, Informative)
Now, if you want to further limit what they can do, you can make many changes to the registry in windows to block users from doing many things such as using the "run" menu, installing applications or a number of other things as simple as changing screen resolution or color depth. Once you set everything up and create the image of your restricted setup, Deep Freeze will maintain it every time for you.
You can get Deep Freeze from here: http://www.faronics.com/ [faronics.com] or look there to find out more information about how it works.
We have tried other products in the past that claimed to "restrict" Windows such that users could not make harmful changes (e.g. OnGuard) but none of the ones we utilized were able to be fool-proof and stop students from getting around it or messing something up. Short of reformatting the machine Deep Freeze is pretty hard for the student to get around. Thawing the machine to make changes requires a lengthy key combination to even bring up the password box (key combination is customizeable by you), or you can enter a key combination on bootup to access the password box to thaw the machine. You can also maintain the systems through a Deep Freeze console so you can admin all the machines at once and even push new images to them that way.
That's my three cents on how we do things in an Academic environment, but our general policy has been slight restrictions but allow them a lot of free reign - except we reset the system every time it is rebooted. I'd suggest for Middle and High school to implement a lot more restrictions on the base image that you use with Deep Freeze than what we have here at the University level.
Not made for XP home (Score:3, Informative)
Lock it down hard (Score:4, Informative)
Most of the student won't try to break things, but a few assholes will so you have to make sure they can do the least amount of damage possible. Unless, of course, you feel like cleaning things up daily.
You could also get an Active Directory domain and push the restrictions that way. I prefer to script it since I prefer to have my servers run Linux.
Re:Check out the microsoft shared computer toolkit (Score:5, Informative)
Basically, make an admin account (call it "school user" for example) and Password protect it install everything using that account, secure using gpedit.msc, Remove CREATOR OWNER permissions on the C:\, C:\program files, C:\windows and C:\windows\system32 folders then log out.
From there, log into administrator (the real one) copy the "school user" profile into the Default user profile using the Users profiles settings found in system properties Giving "everyone" access when you copy the profile, then change the permission manually in the "default user" profile so that everyone cannot write to it. Then make a third user account. Use compmgmt.msc to make that account a member of the guests and users groups. (make sure that guest accounts will delete once they log out. It's in gpedit.msc somewhere) optionally hide both administrator and "school user" and log out of administrator.
Log into the third account and test everything. it should not allow you to install anything if done correctly or write anywhere except for the third user profile. once you log out it should delete the profile (sometimes it doesn't for some reason. This [microsoft.com] helps with that a lot) and the settings should be safe.
Of course I'm assuming XP Pro. I'm pretty sure XP Home doesn't have these utils available.
Re:deep freeze (Score:3, Informative)
Re:An Idea... (Score:3, Informative)
Re:Come on, did you really have to ask Slashdot? (Score:5, Informative)
I'm not affiliated with Faronics in any way.
Group policies are your friend (Score:5, Informative)
VLAN your network. If you have Cisco switches, this should be easy. Set up seperate VLANs for students, the staff, and servers. You'll be able to isolate what resources can be accessed based upon these access lists.
SET UP A PROXY SERVER! Seriously. One of the first systems you should implement is ISA Server 2006. ISA Server will act as an internal proxy to control what users have access to the Internet, and what resources they can access. Set ACLs on your internal switches to prevent routes to the Internet from the student VLAN unless they go through the ISA Server. Set up the ISA Server in front of a filtering appliance, pass all HTTP traffic, and allow access only to HTTPS sites you've added to an allow rule on your ISA server. Add the same limits to SWF, DCR, and possibly java or class files.
Only allow Internet traffic to port 80 and (to a limited extent) 443 for students: Look, your students aren't going to need any other services besides HTTP and HTTPS, and if you're not careful about HTTPS, they'll be popping holes in your proxy using an encrypted web service.
Set your web filtering to deny unrated sites: Students are going to try and circumvent your web filter though phproxy or cgiproxy. The smartest kids will go so far as to set up their own domain to get around your filter. The solution? Block what's not rated. It's also important that your filter have a mechanism to request that a site be unblocked. From a security perspective, it's important that you not open yourself up to risks that you can't control - including websites - but it's also important for the students' development that they have an opportunity to view controversial subjects and make up their own minds about the topic.
Use groups: Set up an OU for each grade in your school. Create a global domain group for each grade. Set up another OU for classes, and create a global security group for each class section. That way, you'll be able to allow or deny access to resources for each grade or class.
Software Restriction Policies: If you have a Server 2003 network, group policies are an amazing asset for your Windows XP clients. Group policies allow you to change settings on users and computers in your network. For instance, you can disable access to the registry or lock down Internet Explorer. Within group policies are a special policy component called Software Restriction Policies that allow you to decide whether or not applications can run based upon the hash, path, or filename. On my network, I designed the SRP around hashes. Managing those policies was a pain (the list was around 400 executables), but it was worth limiting what code would execute on the systems.
Admin tools: You'll want to turn off access to all administrative tools, so disable access to the command prompt, registry editor, and MMC. Also, disable access to the security tab in Explorer to prevent students from changing file permissions. For your computer policies, set the local security policy to disable storing the LM hash for passwords.
Use the Windows firewall: I know it's not much, but it does provide a lot of benefit over nothing at all. Using group policies, configure static rules into the Windows firewall. This will prevent malware from causing problems on your network, and will also prevent iTunes from eating your bandwidth.
Web browsers: It pains me to say this, but don't allow browsers other than Internet Explorer to run on your machines during school. When Firefox adds group policy support, I'll relent on that, but you have no control over what code is executed in Firefox, whereas group policies give you a lot more control over Internet Explorer. Example: after implementing our software restriction policies, students began downloading Flash games in swf form to their laptop hard drives. After receiving complaints from teachers, we simply disabled Firefox through SRPs, and disable
Re:deep freeze (Score:2, Informative)
it can:
freeze
unfreeze
freeze after x reboots.
needless to say my computer had mozilla and winamp on it. jealousy ensued.
just pointing out that deep freeze isn't flawless either
Re:Check out the microsoft shared computer toolkit (Score:3, Informative)
SCT + gparted = crazy delicious (Score:3, Informative)
Windows application control software (Score:5, Informative)
[full disclosure: i work at bit9 -- i couldn't help posting as we see and solve this exact problem all the time
hope this helps; there are other alternatives (imaging/freezing products that others have pointed out) as well.
-drew
Locking Down Windows (Score:2, Informative)
If you have an windows domain the best is to the group policies and create individual accounts to track each of the students.
Group policy http://www.microsoft.com/technet/technetmag/issues /2005/05/LockDown/ [microsoft.com] will also give you a great deal of control over how much of the windows interface they have access to. For instance you can lock out the CLI, and where they can save files. Here is a link from Micro$oft on how to get started.
If you don't have an active directory domain setup, you can still lock down the desktop by creating local policies http://www.windowsnetworking.com/articles_tutorial s/wxppspol.html [windowsnetworking.com], unfortunately you will need to apply these to each PC if all the hardware in the lab is the same, but it wouldn't be to difficult to create a locked down image using Ghost, and then image all the machines to be identical.
Also, if the school can afford it buy a copy of websense http://www.websense.com/global/en/ [websense.com]. It will keep the little buggers out of the internet, prevent them from downloading games, and even using chat programs.
Re:Lock down the user accounts (Score:3, Informative)
The last time I got a new PC at work was the first time it was sourced via a particular department of our corporate owners. It arrived set up such that local admin accounts couldn't even change the desktop background.
Of course, as we've never been properly integrated into the company as a whole, we're not part of the coporate Active Directory structure, so 5 minutes googling and 30 seconds of gpedit.msc fixed that. However the point is that it is indeed possible to lock an XP machine up tight if you know what you're doing and have the infrastructure to support it.
ADS Security and Ghostcast (Score:3, Informative)
* It's relatively simple to lock down users with GPO where all they see is a start menu and specifically what you want to give them. Make sure you remove access to the C: drive. Be warned that there are ways around it so keep you eyes open.
* If you MUST give them net access, force proxy and restrict the hell out of them. Teenagers will look at stuff they're not supposed to and are very creative at getting around firewalls
* Get ghostcast, or opforce, or something free and reimage them every night. You'll thank me later.
* There'll be one or two kids (usually just one) that always manage to get around your restrictions. These are the kids that will one day have hugely successful IT careers. My experience is it's better to give them some extra responsibility to help YOU out, they'll thank you for it.
Re:It can't be done anyway. (Score:3, Informative)
My experience is that the sufficiently motivated students (me and a few others) didn't actually want to play games or anything...so one answer is to allow only the sufficiently motivated students to get past it (not explicitly open it) but threaten them with discipline if they tell others.
And yes, any machine with physical access is inherently insecure. That isn't necessarily a bad thing, if you plan your security model around that. MIT gives out the root passwords for its public machines, for instance, but you can only become root through su-ing from a normal account - and su is logged. (And root doesn't have read access to other user's networked home directories, of course.)
Re:Come on, did you really have to ask Slashdot? (Score:2, Informative)
Deep Freeze (Score:1, Informative)
This is an effective protection against students messing around, but also against hackers, spyware, virus infestations, etc... just restart and the problem is removed.
Downside, of course, is that the computer is equally protected against security updates, administrator-desired software installations, etc-- in order to those, Deep Freeze needs to be disabled and then the computer restarted, which is a bit time-consuming.
Luckily, there's an administrator console version installed on my system-- with it, I can turn Deep Freeze on or off or restart or shut down systems-- in my lab and throughout my school... so I can disable Deep Freeze on all my systems, make any needed changes, then enable it again on all my systems, all without leaving my chair.
Highly recommended for school computer labs and other public computers.
Re:Come on, did you really have to ask Slashdot? (Score:3, Informative)
You're stupid. that's not an example of someone breaking deep-freeze, that's an example of someone dealing with the hardware. That will not help them do anything unauthorized to the software.
And, in any case, that problem can be solved through the use of a lock.
At my former employer, Yuba College, in labs in which they need deep freeze they use it; labs which lack supervision also use locks. Sure, you could cut the lock's cable, but it would take you a little while. Deep Freeze works excellently. Who cares if they alter the OS? It gets restored to factory at the end of the day.
Anyway, back on topic, you could also just go ahead and use ghost or what have you and reload the systems from images at the end of the day... but I'd use deep freeze.
Re:Check out the microsoft shared computer toolkit (Score:3, Informative)
Re:Obligatory Star Wars Quote (Score:2, Informative)
Re:Come on, did you really have to ask Slashdot? (Score:2, Informative)
Documentation: http://www.microsoft.com/technet/prodtechnol/winxp pro/maintain/sct/default.mspx [microsoft.com]
Download: http://www.microsoft.com/windowsxp/sharedaccess/de fault.mspx [microsoft.com]
+1 Use Deep Freeze (Score:4, Informative)
And contrary to other posters, I have seen NO SLOWDOWN. These machines run all the modern games without problems.
One of the best things is that it is completely invisible to the users and does not impose any UI restrictions. Only when you do the special Vulcan nerve pinch AND type in the pw AND reboot the machine do you get any access.
Users seem to be able to do whatever they want, and a reboot is going to undo all of it. (I'm then using additional tweaks to ensure reboots aren't required so often.)
The only isue is that if you want to make one master disk image to mirror to the lab pc's, you need to be very mindful of how you apply DF during the process. It is possible to lock yourself out (wasting the weekend you just spend building the image).
I can't help but give you my utmost recommendation to use this product. (Oh, and I'm not affiliated.)
Physically, our pc's are locked away in cabinets, with only KVM cables going out, and a lockable doorbell-type button to power the thing on. The games CD's are loaded as images, so users never get any hands-on.