Best method for system security?

[McTurok]

Originally Posted by Twinkle

As I said earlier, I'm not interested in protecting against a serious attack - I want to be able to keep nosy people and kids/teens out. The keyboard issue is too easy to bypass. All I'm looking for is for a strong password to be required - whether it's through Sage, or whether it's the Windows login itself.

For example, if Sage pipes output to the TV-Out, as opposed to playing on the monitor and leaving it up to you how it gets to the TV - perhaps it might be possible to login to Windows, start Sage, and then lock the station.

My Sage PC is built into one of those HTPC cases. It's stored in my stereo rack cabinet and plugged into my receiver. The only way to access my Sage pc is to switch to that video output on the TV and use the remote.

Easy enough to remove the keyboard and mouse from the PC and "ding" no one has access to that PC to do anything but really watch content from Sage.

If something crashes, it's simple enough to connect a wire/less mouse or keyboard, but even that doesn't matter because rebooting auto logs me onto the PC and starts up Sage.

PS: To clarify, my monitor is my TV. I have no other computer monitor connected to my Sage PC.

[bastafidli]

I just recommended extender because the amount of time you will spend getting everything setup, configured, working, tweaking and then fixing is just not worth it in my opinion. As i probably wrote, before the extender I used Laptop with Nero Home connected to TV to access our media library and dealing with all the hw and sw issues just wasn't worth it. Since I bought the extender I didn't have to touch anything in my living room (other than getting rid of the DVD and VCR players), anybody in the house and our visitors can easily use it and it just works. After 6 months using it I consider it the best spent money on electronic gadget I have ever spent.

[Razillian]

One of my clients use to run a radiology application on their workstations, and did not want the clients to be able to use the computers as anything but that purpose. So we changed the shell to that program (which was already mentioned as a possibility). We also used Group Policy to limit a ton of things a given user can access, as strict as you would like.

Turning off task manager access is a good start (keeps people from using it to fire up new programs)

Setting the system to only run certain applications (gets tricky because you have to know all the stuff the computer should be running), or setting it to not allow specific applications to run (such as iexplorer.exe, but renaming an applications bypasses this).

Most of the good stuff you might be concerned with is in the User Configuration->System section of Group Policy. (Command Prompt access, registry access, & Custom User Interface (ie set to Sage for the user))

[Conejo]

At a company I worked at we had an employee, too smart for his own good, who was constantly going against company policy and installing stuff in his work PC and crashing the system. I finally asked the IT admin to remap his keyboard, then remap our main application to use it.

That was before I found out about kiosk mode and automatic drive image restore.

[Twinkle]

Thank you for your added inputs on the group policy methods. It's more complicated than I originally envisioned, but if it's the best option, than so be it.

[bastafidli]

I can tell you that much, that our company is trying to do the same and there is ALWAYS a way around it. They disabled WMP, disabled Windows update, etc., etc., etc. Few VBS scripts downloaded from the net, few clicks here and there and all is back. Of course it all depends on how determined users you have.

[Razillian]

Originally Posted by bastafidli

I can tell you that much, that our company is trying to do the same and there is ALWAYS a way around it. They disabled WMP, disabled Windows update, etc., etc., etc. Few VBS scripts downloaded from the net, few clicks here and there and all is back. Of course it all depends on how determined users you have.

In cases like that firing people for violating IT Policies is always a good deterant to keep the remaining people from doing the same.

[DigitalMan]

Why don't you switch to linux? Remove/reconfigure whatever you like.

[CollinR]

Linux has as many downsides as it does upsides and many of us have little/no experience.

Getting sage to work in itself is probably no big deal it's all the extra hardware and software we like to have that makes it tougher.

[bastafidli]

Originally Posted by Razillian

In cases like that firing people for violating IT Policies is always a good deterant to keep the remaining people from doing the same.

In my years in IT I have yet to see anybody being fired for violating IT policies if it doesn't violate law or doesn't involve pr0n.

Actually, we are VERY large organization and have two options, unmanaged PCs where you can do whatever the hell you want to do with your computer (used by quite a bit or people in R&D) or managed PC when the IT department manages it. The problem is that IT likes to have one build for all the people from clerks to directors. I have tried the unmanaged way for a while, but now I like to strike the balance and go with the managed way to take advantage of our hardworking IT folks but tweaking it little bit so it is actually usable for R&D (and other pleasantries :-).