Total Workstation Lockdown:Your Action PlanJeremy Moskowitz, Group Policy MVPChief Propeller-Head: GPanswers.comFounder: PolicyPak Software (policypak.com)Twitter: @jeremymoskowitz

“What I learned in Belgium” – by Jeremy Moskowitz

“What I learned in Belgium” – by Jeremy Moskowitz

“What I learned in Belgium” – by Jeremy Moskowitz

“What I learned in Belgium” – by Jeremy Moskowitz

“What I learned in Belgium” – by Jeremy Moskowitz

“What I learned in Belgium” – by Jeremy Moskowitz

Disclaimer: Don’t go bananas (and don’t expect a ‘Magic Silver Bullet’)

• Tendency to go “overboard”• No “one way” to skin the cat• Not going to go over all possible solutions• No “Silver Bullet.” It’s incremental, iterative, and

ongoing.

• This talk (mostly) Group Policy-based solutions

Item 1: Hardware Lockout

• Scenario• Need to restrict USB / other devices on network

• Perfect for…• Computers• Specific users

• Utilize:• Group Policy (Windows Vista and later)• Group Policy Preferences (Windows XP and later)

Hardware Lockout Demo

Item 2: Understanding Loopback

• Scenario• Need to implement USER side settings to

COLLECTION of computers

• Perfect for…• Call Centers• Classrooms• Terminal Services

Loopback Demo

Item 3: Security Compliance Manager

• Big (free) tool with lots of functions..• Contains pre-configured GPO baselines from the Windows

Security Guides• Lets you create baselines (and manage them)• Output as: GPO, XLS, Desired Configuration Management

(DCM) packs, or Security Content Automation Protocol (SCAP)

• http://technet.microsoft.com/en-us/library/cc677002.aspx

Item 4: Security Compliance Manager

Item 4: Security Compliance Manager

Item 3: Security Compliance Manager

Security Compliance Manager Demo

Item 4: "Workstation Revert"

• Scenario:• Ensures machines won’t be modified in

“hostile” environment

• Perfect for:• Schools• Internet Café• Walk-up machines• Shop Floor / Kiosk / Library• Home use (possibly)

Microsoft’s Solutions

• Windows SteadyState 2.5• Windows XP and Windows Vista only• http://tinyurl.com/steadystate25 • Warning: Being retired as follows:

• No more downloads after 2010• No more support after 2011

• Free Downloadable PDF chapter about SteadyState at www.GPanswers.com/book

• “Going forward” documentation• Creating a Steady State by Using Microsoft Technologies

• Group Policy Settings for Creating a Steady State • The Steady State Reference Spreadsheet

SteadyState-Like Items For Windows 7

• Free• Wioski• Win7 + VHD + WIM “wrapper” / trickery• www.wioski.com

• Commercial• DeepFreeze from Faronics• Win7 Compatible • http://tinyurl.com/DeepFreeze-TechEd2010

Item 5: AppLocker / Software Restriction Policies

• Notes:• AppLocker not available for all editions of Windows 7• Software Restriction Policies IS available for all editions of

Windows 7

• Software Restriction Policies:• Good for Blacklisting

• AppLocker:• Better for Whitelisting

Item 6: Application Settings Lockout

• ADM/ADMX files for supported applications• Office 2010 ADMX files• http://tinyurl.com/Office2010ADMX

• All other applications…• PolicyPak Community Edition (Free)• PolicyPak Professional Edition

Stay up to date with TechNet Belux

Register for our newsletters and stay up to date:http://www.technet-newsletters.be

• Technical updates• Event announcements and registration• Top downloads

Join us on Facebookhttp://www.facebook.com/technetbehttp://www.facebook.com/technetbelux

LinkedIn: http://linkd.in/technetbelux/

Twitter: @technetbelux

Download MSDN/TechNet Desktop Gadget

http://bit.ly/msdntngadget

TechDays 2011 On-Demand

• Watch this session on-demand via TechNet Edge http://technet.microsoft.com/fr-be/edge/

http://technet.microsoft.com/nl-be/edge/

• Download to your favorite MP3 or video player• Get access to slides and recommended resources by the speakers

Do MORE with Group Policy

THANK YOU