"Deep in the sea are riches beyond compare.
But if you seek safety, it is on the shore."

How to secure Windows2000 / XP: Part One

These settings can be used with both Windows2000 and WindowsXP to *really* secure the system and also boost up its performance. Depending upon your version and whether it is Win2k or XP, you might notice that some of the features/options arent there. Just skip and move on until you hit something that IS on YOUR Windows2k/XP. The "best" option of all is to have WindowsXP professional, since the screenshots are from WindowsXP professional.

WindowsXP offers pretty good security features, but only if you know how to use them. By default, WindowsXP is clumsy and has many possible security holes due to its poor default settings. If you use WindowsXP pro, you can really make your computer your fortress against almost any invader. The build-in EFS (Encrypting File System with NTFS), strong authentication methods, etc. give you good tools for it. Home edition does not have all these features but you can always implement your own according to these guidelines. These principles are designed for ONLY single-user "home" computers (standalone), NOT computers in, lets say, corporate networks! On standalone computers you can and should fill all holes possible but in corporate enviroment, the whole point is to allow computers to be used via corporate networks or intranet. You can still take suggestions and clues here and implement them properly if you are installing or using Windows2k/XP in corporate enviroment or are using multiple user accounts.

Getting started
During the installation, you are prompt whether or not you want to use NTFS or FAT. Now this is a tought decision...If you are using Home edition, there is really no reason to use NTFS, its slightly better file system than FAT32, but it has "alternative data streams" and other privacy conciderations...and since you cant use EFS in home edition, I would suggest using FAT32 and PGPdisk. If you are using WindowsXP Pro version, then you should move to NTFS.

There is very little reason to use NTFS/EFS on Win2k standalone installation since it does not offer real protection in Windows2k. It is possible to reset the administrators passphrase (even with Syskey enabled and stored in floppy) and login as admin. This can be done by simply booting the computer in other operating system and deleting the SAM file and manipulating the registry so that Windows does not want to have Syskey during startup. If Syskey is not present, resetting the administrators passphrase is much easier. Administrator can do many things and is the default recovery agent of EFS.

In theory, it *is* possible in standalone Windows2000 to have secure EFS, but it is very, very, very complicated to archive. In theory, by exporting the administrators recovery certificate or designating some other recovery agent AND implementing Syskey to passphrase or floppy, it *might* be possible to prevent anyone from reading EFS encrypted files. It is always possible to login as administrator, but if the administrator does not have the recovery keys, he cant decrypt EFS files... And since the Syskey *prevents* tampering the other accounts, it is in *theory* safe (if hacker deletes SAM file, then other accounts loose their vital piece of information and cant be used and therefore they cant get access to private key). But in practise...well...who really knows? I STRONGLY recommend not to use EFS in Windows2000 unless the computer is a part of domain and the settings/security policies are good and the actual computer where the certificates are stored is in safe place so nobody can get a physical access to it and Syskey for each computer is stored in passphrase or in floppy format. Use PGPdisk instead and you dont have to worry about these kinds of issues with Windows2000!

-Markus Jansson