Total Workstation Lockdown: Your Action Plan

1. Total Workstation Lockdown:Your Action Plan Jeremy Moskowitz, Group Policy MVP Chief Propeller-Head: GPanswers.com Founder: PolicyPak Software (policypak.com) Twitter: @jeremymoskowitz

2. “What I learned in Belgium” – by Jeremy Moskowitz

3. “What I learned in Belgium” – by Jeremy Moskowitz

4. “What I learned in Belgium” – by Jeremy Moskowitz

6. “What I learned in Belgium” – by Jeremy Moskowitz

7. “What I learned in Belgium” – by Jeremy Moskowitz

8. “What I learned in Belgium” – by Jeremy Moskowitz

9. Disclaimer: Don’t go bananas (and don’t expect a ‘Magic Silver Bullet’) • Tendency to go “overboard” • No “one way” to skin the cat • Not going to go over all possible solutions • No “Silver Bullet.” It’s incremental, iterative, and ongoing. • This talk (mostly) Group Policy-based solutions

10. Item 1: Hardware Lockout • Scenario • Need to restrict USB / other devices on network • Perfect for… • Computers • Specific users • Utilize: • Group Policy (Windows Vista and later) • Group Policy Preferences (Windows XP and later)

11. Hardware Lockout Demo

12. Item 2: Understanding Loopback • Scenario • Need to implement USER side settings to COLLECTION of computers • Perfect for… • Call Centers • Classrooms • Terminal Services

13. Loopback Demo

14. Item 3: Security Compliance Manager • Big (free) tool with lots of functions.. • Contains pre-configured GPO baselines from the Windows Security Guides • Lets you create baselines (and manage them) • Output as: GPO, XLS, Desired Configuration Management (DCM) packs, or Security Content Automation Protocol (SCAP) • http://technet.microsoft.com/en-us/library/cc677002.aspx

15. Item 4: Security Compliance Manager

16. Item 4: Security Compliance Manager

17. Item 3: Security Compliance Manager

18. Security Compliance Manager Demo

19. Item 4: "Workstation Revert" • Scenario: • Ensures machines won’t be modified in “hostile” environment • Perfect for: • Schools • Internet Café • Walk-up machines • Shop Floor / Kiosk / Library • Home use (possibly)

20. Microsoft’s Solutions • Windows SteadyState 2.5 • Windows XP and Windows Vista only • http://tinyurl.com/steadystate25 • Warning: Being retired as follows: • No more downloads after 2010 • No more support after 2011 • Free Downloadable PDF chapter about SteadyState at www.GPanswers.com/book • “Going forward” documentation • Creating a Steady State by Using Microsoft Technologies • Group Policy Settings for Creating a Steady State • The Steady State Reference Spreadsheet

21. SteadyState-Like Items For Windows 7 • Free • Wioski • Win7 + VHD + WIM “wrapper” / trickery • www.wioski.com • Commercial • DeepFreeze from Faronics • Win7 Compatible • http://tinyurl.com/DeepFreeze-TechEd2010

22. Item 5: AppLocker / Software Restriction Policies • Notes: • AppLocker not available for all editions of Windows 7 • Software Restriction Policies IS available for all editions of Windows 7 • Software Restriction Policies: • Good for Blacklisting • AppLocker: • Better for Whitelisting

23. Item 6: Application Settings Lockout • ADM/ADMX files for supported applications • Office 2010 ADMX files • http://tinyurl.com/Office2010ADMX • All other applications… • PolicyPak Community Edition (Free) • PolicyPak Professional Edition

24. Stay up to date with TechNet Belux Register for our newsletters and stay up to date:http://www.technet-newsletters.be • Technical updates • Event announcements and registration • Top downloads Join us on Facebook http://www.facebook.com/technetbehttp://www.facebook.com/technetbelux LinkedIn: http://linkd.in/technetbelux/ Twitter: @technetbelux DownloadMSDN/TechNet Desktop Gadgethttp://bit.ly/msdntngadget

25. TechDays 2011 On-Demand • Watchthis session on-demand via TechNet Edge http://technet.microsoft.com/fr-be/edge/http://technet.microsoft.com/nl-be/edge/ • Download to your favorite MP3 or video player • Get access to slides and recommended resources by the speakers

26. Do MORE with Group Policy

27. THANK YOU