Least Privilege Security for Windows 7, Vista and XP. Secure desktops for regulatory compliance and business agility - Ebook - Russell Smith - Modern learning platform

E-book details

Log in, If you're interested in the contents of the item.

Least Privilege Security for Windows 7, Vista and XP. Secure desktops for regulatory compliance and business agility

Ebook

Least Privilege Security is the practice of assigning users and programs the minimum permissions required to complete a given task. Implementing this principle in different versions of Microsoft Windows requires careful planning and a good understanding of Windows security. While there are benefits in implementing Least Privilege Security on the desktop, there are many technical challenges that you will face when restricting privileges.This book contains detailed step-by-step instructions for implementing Least Privilege Security on the desktop for different versions of Windows and related management technologies. It will provide you with quick solutions for common technical challenges, Microsoft best practice advice, and techniques for managing Least Privilege on the desktop along with details on the impact of Least Privilege Security.The book begins by showing you how to apply Least Privilege Security to different categories of users. You will then prepare a desktop image with Least Privilege Security enabled from the start and deploy the new image while preserving users' files and settings. You will identify problems with applications caused by Least Privilege Security using the Application Compatibility Toolkit. This book will help you configure User Account Control on multiple computers using Group Policy and support Least Privilege user accounts using reliable remote access. Then, you will modify legacy applications for Least Privilege Security, achieving the best balance between compatibility and security by using Application Compatibility shims. You will install per-machine ActiveX Controls using the ActiveX Installer Service (AxIS). The book will help you implement best practices for working with ActiveX Controls in a managed environment. Finally, you will deploy default Software Restriction Policy (SRP) or AppLocker rules to ensure only programs installed in protected locations can run and blacklist applications using SRP or AppLocker.

Least Privilege Security for Windows 7, Vista and XP
- Table of Contents
- Least Privilege Security for Windows 7, Vista and XP
- Credits
- About the Author
- About the Reviewers
- Preface
  - What this book covers
  - What you need for this book
  - Who this book is for
  - Conventions
  - Reader feedback
  - Customer support
    - Errata
    - Piracy
    - Questions
- 1. An Overview of Least Privilege Security in Microsoft Windows
  - What is privilege?
  - What is Least Privilege Security?
    - Limiting the damage from accidental errors with Least Privilege Security
    - Reducing system access to the minimum with Least Privilege Security
  - Least Privilege Security in Windows
    - Windows 9.x
    - Windows NT (New Technology)
    - Windows 2000
    - Windows XP
    - Windows Vista
    - Windows 7
  - Advanced Least Privilege Security concepts
    - Discretionary Access Control
    - Mandatory Access Control
    - Mandatory Integrity Control
    - Role-based Access Control
  - Least Privilege Security in the real world
  - Benefits of Least Privilege Security on the desktop
    - Change and configuration management
    - Damage limitation
    - Regulatory compliance
    - Software licensing
  - What problems does Least Privilege Security not solve?
  - Common challenges of Least Privilege Security on the desktop
    - Application compatibility
    - System integrity
    - End user support
  - Least Privilege and your organizations bottom line
    - Determining the affect of Least Privilege Security on productivity
    - Reducing total cost of ownership
    - Improved security
  - Summary
- 2. Political and Cultural Challenges for Least Privilege Security
  - Company culture
    - Defining company culture
    - Culture shock
    - Culture case studies
      - Company A
      - Company B
  - Getting support from management
    - Selling Least Privilege Security
      - Using key performance indicators
      - Using key risk indicators
      - Mapping CSFs to KPIs
      - Security metrics
      - Threat modeling
      - Reducing costs
      - Security adds business value
    - Setting an example
  - User acceptance
    - Least Privilege Security terminology
    - Justifying the decision to implement Least Privilege Security
  - Applying Least Privilege Security throughout the enterprise
    - Deciding whom to exempt from running with a standard user account
      - What not to do
  - Managing expectations
    - Service catalog
    - Chargebacks
  - Maintaining flexibility
  - User education
  - Summary
- 3. Solving Least Privilege Problems with the Application Compatibility Toolkit
  - Quick compatibility fixes using the Program Compatibility Wizard
    - Applying compatibility modes to legacy applications
    - Program Compatibility Wizard
    - Program Compatibility Assistant
      - Disabling the Program Compatibility Assistant
      - Excluding executables from the Program Compatibility Assistant
  - Achieving application compatibility in enterprise environments
    - Compatibility fixes
      - Modifying applications using shims
      - Enhancing security using compatibility shims
      - Deciding whether to use a shim to solve a compatibility problem
        
        Vendor support
        
        In-house applications
        
        Kernel-mode applications
    - Creating shims for your legacy applications
    - Solving compatibility problems with shims
      - LUA compatibility mode fixes in Windows XP
        
        LUARedirectFS
        
        LUARedirectFS_Cleanup
        
        LUARedirectReg
        
        LUARedirectReg_Cleanup
        
        LUATrackFS
      - Creating your own custom database
      - Maxthon on Windows XP
      - Working with other commonly used compatibility fixes
        
        ForceAdminAccess
        
        CorrectFilePaths
        
        VirtualRegistry
        
        ADDREDIRECT
    - Working with custom databases
      - Adding new shims to your custom database (merging custom databases)
      - Temporarily disabling compatibility fixes
      - Installing a custom database from Compatibility Administrator
      - Deploying a database to multiple devices
        
        Finding the GUID of custom database
        
        SDBINST command-line switches
        
        Distributing or updating a custom database using Group Policy
  - Summary
- 4. User Account Control
  - User Account Control components
    - Elevation prompts
    - Protected administrator (PA)
    - Windows Integrity Control and User Interface Privilege Isolation
    - Application Information Service
    - Filesystem and registry virtualization
    - Internet Explorer Protected Mode
  - The shield icon
  - User Account Control access token model
    - Standard user access token
    - Protected administrator access token
  - Conveniently elevating to admin privileges
    - Automatically launching applications with admin privileges
    - Consent and credential elevation prompts
      - Consent prompts
        
        Credential prompts
    - Application-aware elevation prompts
      - Windows Vista
        
        Publisher verified (signed)
        
        Publisher not verified (unsigned)
        
        Publisher blocked
    - Administrator accounts
    - Elevation prompt security
      - Securing the desktop
        
        Providing extra security with the Secure Attention Sequence (SAS)
    - Securing elevated applications
      - Windows Integrity Mechanism
        
        Integrity policies
        
        Assigning integrity levels
      - User Interface Privilege Isolation
        
        User Interface Privilege Level
        
        UIPI and accessibility
    - Achieving application compatibility
      - Application manifest
      - Power Users
      - Windows Logo Program
        
        Certification requirements
    - Filesystem and registry virtualization
      - Filesystem virtualization
        
        Virtual root directory
      - Registry virtualization
        
        Virtual root registry
        
        Using Task Manager to determine whether a process is using UAC filesystem and registry virtualization
    - Windows Installer and User Account Control
      - Automatically detecting application installers
    - Controlling User Account Control through Group Policy
      - Admin Approval Mode for the built-in administrator account
      - Allowing UIAccess applications to prompt for elevation without using the secure desktop
      - Behavior of the elevation prompt for administrators in Admin Approval Mode
      - Behavior of the elevation prompt for standard users
      - Detect application installations and prompt for elevation
      - Only elevate executables that are signed and validated
      - Only elevate UIAccess applications that are installed in secure locations
      - Run all administrators in Admin Approval Mode
      - Switch to the secure desktop when prompting for elevation
      - Virtualize file and registry write failures to per-user locations
    - What's new in Windows 7 User Account Control
      - User Account Control slider
      - Auto-elevation for Windows binaries
        
        Executables
        
        Microsoft Management Console (MMC)
        
        Component Object Model (COM) objects
      - More settings accessible to standard users
  - Summary
- 5. Tools and Techniques for Solving Least Privilege Security Problems
  - Granting temporary administrative privileges
    - Granting temporary administrative access using a separate logon (Vista and Windows 7 only)
      - Creating three support accounts
      - Creating a policy setting to automatically delete the support account at logoff
      - Testing the support accounts
      - Putting into practice
    - Granting temporary administrative access without a separate logon
      - Creating a batch file to elevate the privileges of the logged in user
      - Testing the procedure
      - Limitations of the procedure
  - Bypassing user account control for selected operations
    - Using Task Scheduler to run commands with elevated privileges
      - Running the Scheduled Task as a standard user
  - Configuring applications to run with elevated privileges on-the-fly
  - Solving LUA problems with Avecto Privilege Guard
    - Defining application groups
    - Defining access tokens
    - Configuring messages
    - Defining policies
    - Solving LUA problems with Privilege Manager
      - Defining Privilege Manager rules
        
        Assigning permissions
        
        Adding or removing individual privileges
        
        Specifying integrity levels
  - Suppressing unwanted User Account Control prompts
    - Modifying application manifest files
      - Editing manifests using Resource Tuner
      - Modifying manifests using the RunAsInvoker shim
  - Setting permissions on files and registry keys
    - Identifying problems using Process Monitor
    - Modifying permissions on registry keys and files with Group Policy
  - Fixing problems with the HKey Classes Root registry hive
    - Using Registry Editor to copy keys from HKCR to HKCU
  - Mapping .ini files to the registry
  - Using LUA Buglight to identify file and registry access violations
  - Summary
- 6. Software Distribution using Group Policy
  - Installing software using Group Policy
    - Installing software using Windows Installer
    - Deploying software using Group Policy
    - Comparing Group Policy Software Installation with system images for software distribution
      - Choosing between thin and fat images
    - Preparing applications for deployment
      - Extracting .msi files from setup packages
        
        Using WinRAR or 7-Zip to extract .msi files
      - Using command-line switches for silent installs and customization
      - Deploying system changes using Group Policy startup scripts
      - Creating an .msi wrapper
      - Repackaging an application with a legacy installer
        
        Installing AdminStudio
        
        Configuring AdminStudio's Repackager to run on a remote machine
        
        Installing the remote repackager
        
        Monitoring a legacy installation routine
    - Customizing an installation package
      - Customizing Acrobat Reader's MSI installer using Adobe Customization Wizard 9
    - Using the Distributed File System with GPSI
      - Creating a DFS namespace
      - Adding a folder to the namespace
    - Deploying software using GPSI
      - Configuring software installation settings
      - Targeting devices using WMI filters and security groups
        
        Active Directory security groups
        
        Creating a security group to filter a GPO
        
        Windows Management Instrumentation filtering
    - Upgrading software with GPSI
    - Uninstalling software with GPSI
      - Removing software when it falls out of scope of management
      - Removing .msi packages from Group Policy Objects
  - Summary
- 7. Managing Internet Explorer Add-ons
  - ActiveX controls
    - Per-user ActiveX controls
      - Changing the installation scope to per-user
    - Best practices
    - Deploying commonly used ActiveX controls
      - Deploying Adobe Flash and Shockwave Player
      - Deploying Microsoft Silverlight
    - ActiveX Installer Service
      - Enabling the ActiveX Installer Service
        
        Using the GUI to install the ActiveX Installer Service
        
        Using the command line to install the ActiveX Installer Service
      - Determining the ActiveX control host URL in Windows 7
      - Determining the ActiveX control host URL in Windows Vista
      - Configuring the ActiveX Installer Service with Group Policy
      - Testing the ActiveX Installer Service
  - Managing add-ons
    - Administrator approved controls
      - Determining the Class Identifier CLSID of an installed ActiveX control
      - Adding ActiveX controls to the Add-on List
  - Summary
- 8. Supporting Users Running with Least Privilege
  - Providing support
    - Preparing to support least privilege
  - Troubleshooting using remote access
    - Troubleshooting for notebook users
      - The notebook challenge
      - Having the right tools in place
      - Notebook users who seldom visit the office
      - Setting out IT policy
      - Other functions the help desk might require
      - The last resort: An administrative backdoor for notebooks
  - Enabling and using command-line remote access tools
    - WS-Management
      - Configuring WS-Management with Group Policy
      - Connecting to remote machines using WS-Management
        
        Running standard Windows commands as an administrator on remote computers
        
        Enumerating information using Windows Management Instrumentation
        
        Performing actions on remote computers as an administrator using WMI methods
        
        Connecting to WS-Management 1.1 from Windows Server 2008 R2
        
        Working with WS-Management security
    - Automating administration tasks using PowerShell Remoting
  - Enabling and using graphical remote access tools
    - Enabling Remote Assistance
      - Different types of Remote Assistance
      - Enabling Remote Assistance via Group Policy
      - Offering a computer unsolicited Remote Assistance: DCOM
      - Sending Remote Assistance invitations
      - Initiating Remote Assistance from the command line
      - Connecting to remote PCs using Easy Connect
        
        Enabling Remote Assistance with Network Address Translation
    - Remote Desktop
    - Connecting to a remote computer using the Microsoft Management Console (MMC)
  - Configuring Windows Firewall to allow remote access
    - Creating a GPO for Windows Firewall in Windows 7
      - Importing Windows 7 Firewall rules to a GPO
      - Modifying the default Windows Firewall rules
      - Adding additional inbound exceptions for remote administration
      - Creating a WMI filter to restrict the scope of management to Windows 7
      - Linking the new GPO to the Client OU
      - Checking the GPO applies to Windows 7
    - Creating a GPO for Windows Firewall in Vista
      - Enabling the Remote Assistance and Remote Administration inbound exceptions for the Domain profile
      - Creating a WMI query for Windows Vista
    - Creating a GPO for Windows Firewall in Windows XP
      - Configuring GPO settings
      - Creating an exception for WS-Management
      - Creating an exception for Remote Desktop
      - Creating an exception for Remote Administration
      - Creating an exception for Remote Assistance
      - Creating a WMI filter to restrict the scope of management to Windows XP
      - Linking the new GPO to the Client OU
  - Summary
- 9. Deploying Software Restriction Policies and AppLocker
  - Controlling applications
    - Blocking portable applications
    - Securing Group Policy
      - Preventing users from circumventing Group Policy
  - Implementing Software Restriction Policy
    - Creating a whitelist with Software Restriction Policy
      - Defining hash rules
      - Defining path rules
      - Trusting software signed by a preferred publisher (Certificate Rules)
      - Making exceptions for IE zones (Network/Internet Zone Rule)
    - Creating a whitelist with Software Restriction Policy
    - Configuring applications to run as a standard user
  - AppLocker
    - Automatically generating AppLocker rules
    - Manually creating an AppLocker rule to blacklist an application
    - Importing and exporting AppLocker rules
  - Summary
- 10. Least Privilege in Windows XP
  - Installing Windows XP using the Microsoft Deployment Toolkit
    - Providing a Volume License product key for an MDT XP Task Sequence
  - Windows XP security model
    - Power users
    - Network Configuration Operators
    - Support_<1234>
    - User rights
      - Modifying logon rights and privileges
        
        Logon rights
        
        Privileges
  - CD burning
    - Third-party CD/DVD burning software
      - Nero Burning ROM
        
        Installing Nero BurnRights
        
        Configuring Nero BurnRights from the command line
      - Allowing non-administrative users to burn discs in CDBurnerXP
    - Additional security settings
      - Restricting access to removable media
  - ActiveX controls
    - Flash Player
    - Acrobat Reader
    - Silverlight
    - Other popular ActiveX controls
      - RealPlayer
      - QuickTime
      - Sun Java Runtime Environment
      - Alternatives to QuickTime and RealPlayer
  - Changing the system time and time zone
    - Changing the system time
    - Changing the time zone
      - Setting time zone registry permissions using a GPO
  - Power management
    - Managing power settings with Group Policy Preferences
      - Creating a GPO startup script to install GPP CSEs
      - Configuring power options using Group Policy Preferences
    - Configuring the registry for access to power settings
  - Managing network configuration
    - Configuring Restricted Groups
  - Identifying LUA problems using Standard User Analyzer
  - Summary
- 11. Preparing Vista and Windows 7 for Least Privilege Security
  - The Application Compatibility Toolkit
    - Application Compatibility Manager
    - Installing and configuring ACT
  - Creating a Data Collection Package
    - Analyzing data collected by ACT
      - The application attempted to store a file in a restricted location
        
        The application attempted to store a file in a system location that was virtualized by Windows Vista
        
        The application attempted to open a restricted registry key and write to a restricted registry location
        
        The application attempted to store information under the HKEY_LOCAL_MACHINE\SOFTWARE registry hive
  - Printers and Least Privilege Security
    - Installing printers using Group Policy Preferences
    - Installing printers using Windows Server 2003 Print Management and Group Policy
    - Installing printers using a script
  - Logon scripts
    - Synchronizing the system time
    - Updating antivirus definitions
    - Changing protected system configuration
    - Mapping network drives and printers
    - Creating desktop shortcuts
  - Why do a desktop refresh from a technical perspective?
  - Different methods of reinstalling Windows
    - Manual, non-destructive install
    - Automated install
  - Reinstall Vista or Windows 7 with Least Privilege Security
    - Installing the Microsoft Deployment Toolkit
    - Creating a deployment share
    - Adding an operating system image
    - Adding core packages to our Lite Touch installation
      - Creating a Lite Touch task sequence
    - Updating our deployment share
    - Preserving default local group membership
    - Refreshing our OS with the Windows Deployment Wizard
  - Summary
- 12. Provisioning Applications on Secure Desktops with Remote Desktop Services
  - Introducing Remote Desktop Services
    - Installing Remote Desktop Session Host and Licensing roles
    - Controlling access to the Remote Desktop Server
    - Installing the Remote Desktop Gateway
      - Creating Connection (CAP) and Resource (RAP) Authorization Policies
      - Installing the RD Gateway SSL Certificate in Windows 7
      - Connecting to a Remote Desktop Server via an RD Gateway from Windows 7
    - Installing applications on Remote Desktop Servers
      - Publishing applications using Remote Desktop Services
        
        Adding applications to the RemoteApp Manager
    - Managing Remote Desktop Services licenses
      - Understanding Remote Desktop Licensing
      - Revoking Per Device Remote Desktop Services Client Access Licences
      - Tracking Per User Remote Desktop Services Client Access Licences
    - Installing Remote Desktop Web Access
      - Configuring RSS for advertising RemoteApps in Windows 7
    - Understanding Remote Desktop and Virtual Desktop Infrastructures
    - Scaling with Remote Desktop Services
  - Summary
- 13. Balancing Flexibility and Security with Application Virtualization
  - Microsoft Application Virtualization 4.5 SP1 for Windows desktops
    - Isolating applications with SystemGuard
      - Deploying App-V
        
        Deploying App-V using the standalone model
        
        Deploying App-V using the streaming model
        
        Deploying App-V using the full infrastructure
    - Creating a self-service system with App-V for standard users
      - Enforcing security descriptors
      - Emulating Application Programming Interface (API)
      - Solving App-V compatibility problems with shims
    - Sequencing an application for App-V
      - Installing the sequencer
      - Installing the client
    - Streaming applications with an App-V Server
      - Installing Microsoft System Center Application Virtualization Streaming Server
    - Deploying and managing applications for users who never connect to the corporate intranet
    - Updating applications and Differential Streaming
      - Active Update
      - Override URL
  - VMware ThinApp
  - Summary
- 14. Deploying XP Mode VMs with MED-V
  - Solving least privilege security problems using virtual machines
    - Virtual PC and Windows 7 XP Mode
      - Differentiating between App-V and XP Mode
      - Setting up Windows 7 XP Mode
      - Launching applications installed in XP Mode from the Windows 7 Start menu
      - Security concerns when running XP Mode
  - Microsoft Enterprise Desktop Virtualization (MED-V)
    - Installing MED-V 1.0 SP1
      - Installing the Image Repository
      - Installing the MED-V Server component
      - Installing the MED-V Management Console
    - Preparing a virtual machine for use with MED-V
    - Working with the MED-V Management Console
      - Importing a VM for testing
      - Creating a usage policy
      - Testing the workspace and usage policy
      - Packing the VM for use with the MED-V Server
      - Uploading the VM image to the MED-V Server
      - Testing the uploaded VM image
  - Summary
- Index

Title: Least Privilege Security for Windows 7, Vista and XP. Secure desktops for regulatory compliance and business agility
Author: Russell Smith
Original title: Least Privilege Security for Windows 7, Vista and XP. Secure desktops for regulatory compliance and business agility
ISBN: 9781849680059, 9781849680059
Date of issue: 2010-07-05
Format: Ebook
Item ID: e_3b2o
Publisher: Packt Publishing

select a language

Categories

E-book details