T 'n' T: Desperately Seeking Security Make Things Tough for Would-Be Intruders Gregg Keizer
Tue 9/3/02 -- Keeping Windows safe, your files secure, and your PC protected is a full-time job. Not only does Windows have more holes than a Krispy Kreme production line, but figuring out how to stay abreast of and configure fixes for security concerns can be a nightmare.
This week's tips 'n' tricks show you how to stay on top of security issues, control who in your home has dial-out access to the Internet, apply Windows XP Professional's advanced file security to Windows XP Home Edition, and more. Let's be careful out there.
Keep up with security stuff. News of hackers' exploits, Windows vulnerabilities, and patches or fixes flows so steadily that it's almost impossible to keep pace with the deluge. Have no fear.
The lazy person's way is to let Microsoft take care of repairs with Windows Update (see this January column on the subject). But if you're a real stickler for security, you'll want to take a more proactive approach. Bookmark Microsoft's Security & Privacy page, and visit it regularly. Pay attention to the security bulletins posted at the far right of the page.
Another avenue is to subscribe to Microsoft's free Security Notification Service, which sends e-mail alerts about security failures and fixes on a regular (too regular!) basis. You'll need a Passport account to sign up.
Fire(wall) when ready. You probably know that Windows XP includes a basic Internet Connection Firewall (actually a subset of Tiny Personal Firewall) -- that provides decent, though not superb, security against hackers and some Trojan horses. To turn on this firewall, choose Settings/Network Connections from the Start menu and right-click the connection you want to protect.
Pick Properties, click the Advanced tab, and check the box labeled "Protect my computer and network by limiting or preventing access to this computer from the Internet." Click OK. If you want more rigorous protection, check out either the free or more potent paid versions of firewalls like Zone Labs' ZoneAlarm or Symantec's firewall-and-antivirus bundle Norton Internet Security.
Only you can dial. Windows XP will cache your Dial-Up Networking username and password so you don't need to reenter them each time you log on. That's great, but what if you want to keep others using your PC from connecting?
The simplest way is to not check the "Save this username and password for the following users" box in the Dial-Up Networking dialog. Another is to check the "Me only" button so that only you -- via your login name and password -- get to use this feature.
But to disable this feature entirely, you need to edit the Registry. From the Start menu, select Run, type REGEDIT, and press Enter. Look for the following key:
Right-click this item in the left-hand pane and choose New/DWORD Value. Name it DisableSavePassword. Double-click the new entry in the right-hand pane and enter 1 as the value. Click OK. (You may need to restart Windows or log off and back on for this change to take effect.)
Now when you open a dial-up connection dialog, "Save this username and password" is grayed out, and you must manually enter both username and password each time you try to connect.
Boost Win XP Home's file security. Windows XP Professional includes an advanced file and folder security feature that lets you set specific privileges for each user -- allowing your spouse, say, to run Quicken, while keeping your kids from seeing your (dismal) financial situation, or permitting others to read a particular file but not edit or change it.
Windows XP Home Edition lacks this additional security. Or does it? Actually, you can access these same settings from Win XP Home, but only after booting into Safe mode. Once you've changed the file and folder privileges you desire, you simply reboot normally and the changes are in effect. One caveat: your hard disk must use the NTFS file format (for a how-to on converting from the FAT or FAT32 to NTFS format, check out this Microsoft Support document.)
Boot into Safe mode by pressing the F8 key during the first moments of the boot process and picking "Safe Mode" from the list. Once Windows has booted into Safe mode, open Windows Explorer and right-click any file or folder, then click on the Security tab and make your selections. Click OK, then reboot normally.
Reset screensaver password. You got smart and locked your desktop with a screensaver password, but now you've forgotten the password? Yikes!
Reboot your PC. Before the screensaver kicks in, choose Run from the Start menu and type REGEDIT. Press Enter. Look for this key:
HKEY_CURRENT_USER\Control Panel\Desktop
Delete the value ScreenSave_Data in the right-hand pane. Close the Registry Editor.
