Securing a High School Windows XP Computer Lab? 533
An anonymous reader asks: "My SO just inherited a computer lab from a departed teacher who was no security guru. These are Windows XP systems, and security basically consists of a password on the admin account, a subscription to McAfee Security Center, and a free Internet filter. The students have access through a non-passworded 'limited' user account that doesn't seem to limit much. They have been going in and changing settings, downloading games and music, and generally screwing the computers up during class time, in many cases leaving them unusable. As the geek in our house, she has asked me to give her a hand, but while I have dealt with some security issues in the past, it was to protect against remote intruders, not against someone who has to have access to the keyboard. Any suggestions on the best way to lock these systems down?"
Come on, did you really have to ask Slashdot? (Score:3, Insightful)
Re:Come on, did you really have to ask Slashdot? (Score:4, Funny)
Re:Come on, did you really have to ask Slashdot? (Score:5, Informative)
I'm not affiliated with Faronics in any way.
+1 Use Deep Freeze (Score:4, Informative)
And contrary to other posters, I have seen NO SLOWDOWN. These machines run all the modern games without problems.
One of the best things is that it is completely invisible to the users and does not impose any UI restrictions. Only when you do the special Vulcan nerve pinch AND type in the pw AND reboot the machine do you get any access.
Users seem to be able to do whatever they want, and a reboot is going to undo all of it. (I'm then using additional tweaks to ensure reboots aren't required so often.)
The only isue is that if you want to make one master disk image to mirror to the lab pc's, you need to be very mindful of how you apply DF during the process. It is possible to lock yourself out (wasting the weekend you just spend building the image).
I can't help but give you my utmost recommendation to use this product. (Oh, and I'm not affiliated.)
Physically, our pc's are locked away in cabinets, with only KVM cables going out, and a lockable doorbell-type button to power the thing on. The games CD's are loaded as images, so users never get any hands-on.
Re: (Score:3, Informative)
You're stupid. that's not an example of someone breaking deep-freeze, that's an example of someone dealing with the hardware. That will not help them do anything unauthorized to the software.
And, in any case, that problem can be solved through the use of a lock.
At my former employer, Yuba College, in labs in which they need
Windows application control software (Score:5, Informative)
[full disclosure: i work at bit9 -- i couldn't help posting as we see and solve this exact problem all the time
hope this helps; there are other alternatives (imaging/freezing products that others have pointed out) as well.
-drew
Easy solution (Score:4, Funny)
Obligatory Star Wars Quote (Score:5, Funny)
Terminal server, drive images, isolated network (Score:4, Funny)
Re: (Score:3, Funny)
Re: (Score:2)
Check out the microsoft shared computer toolkit (Score:5, Informative)
Is a good place to start for newbies. Or if these are XP pro machines you can use gpedit.msc (start->run->gpedit.msc)
If these are XP home machines try this http://www.dougknox.com/xp/tips/xp_home_sectab.ht
Not made for XP home (Score:3, Informative)
Re:Check out the microsoft shared computer toolkit (Score:5, Informative)
Basically, make an admin account (call it "school user" for example) and Password protect it install everything using that account, secure using gpedit.msc, Remove CREATOR OWNER permissions on the C:\, C:\program files, C:\windows and C:\windows\system32 folders then log out.
From there, log into administrator (the real one) copy the "school user" profile into the Default user profile using the Users profiles settings found in system properties Giving "everyone" access when you copy the profile, then change the permission manually in the "default user" profile so that everyone cannot write to it. Then make a third user account. Use compmgmt.msc to make that account a member of the guests and users groups. (make sure that guest accounts will delete once they log out. It's in gpedit.msc somewhere) optionally hide both administrator and "school user" and log out of administrator.
Log into the third account and test everything. it should not allow you to install anything if done correctly or write anywhere except for the third user profile. once you log out it should delete the profile (sometimes it doesn't for some reason. This [microsoft.com] helps with that a lot) and the settings should be safe.
Of course I'm assuming XP Pro. I'm pretty sure XP Home doesn't have these utils available.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re: (Score:2)
Virtual Machines (Score:5, Insightful)
Lock down the user accounts (Score:5, Insightful)
Re: (Score:3, Informative)
The last time I got a new PC at work was the first time it was sourced via a particular department of our corporate owners. It arrived set up such that local admin accounts couldn't even change the desktop background.
Of course, as we've never been properly integrated into the company as a whole, we're not part of the coporate Active Directory structure, so 5 minutes googling and 30 seconds of gpedit
Re:Lock down the user accounts (Score:4, Insightful)
You don't even have to go very far with this: just give them "user" accounts. Windows comes with three main user groups built-in: administrators, power users, users. Unless someone has messed things up, "users" shouldn't be able to install things or mess with the actual system.
Now, the other part of this (and this is important) is that you have to find a way to restrict student's access to the physical machines as much as possible. The ideal would be to put the actual machine in a locking cabinet or something (with some amount of air-flow so they don't overheat). If you really want to keep the computers secure, you don't want those kids getting access to so much as a CD-ROM drive or USB port. Really, a simple lock-down will keep most kids out of trouble, but you never know when some kid is going to figure out how to reset your Windows admin password with a Linux live CD.
Lock the accounts, and secure the admin. (Score:3, Insightful)
and secure the admin password!
Seriously, at my jr high we had all the locked-down stuff we could want. Didn't do any good at all because they only changed the password to control the lockdown software (this was Win98 I think) once/quarter, and it would be seen or guessed within 2 weeks. I'm not sure how this hasn't come up yet in the discussion... but any relatively computer-literate kid could make an Admin account that looks just like the normal (limited) account to all but
deep freeze (Score:5, Informative)
Please note i'm not associated with faronics or deep freeze in any way, just found the program useful and thought it might help you out.
Re: (Score:2, Informative)
Comment removed (Score:5, Insightful)
Re:deep freeze (Score:4, Interesting)
In the school I worked, the kids had no problem re-downloading the programs and music every. single. day. I assumed finding and re-downloading the stuff was more fun than listening to the teacher anyway. Plus, most of them started playing flash-games on the game websites as well.
Deep-freeze will keep the OS from being permanently destroyed by student/virus/whatever, but it doesn't make it any less of a distraction in the classroom if it is not further locked down.
You disagree -- That is your opinion. Let me tell you why I believe you are wrong. You use something like deepfreze to lock the PC. Then you have a content filter to block the crap the students are doing online that they should not be. Right tool for the job, and all that.
At one particular school I used to do some work for (before moving to a higher paying job), I set up a linux (Gentoo, in case it matters) server that did Samba, iptables, squid/squidguard, etc. When teachers would catch their students doing things they ought not to be, the web site was written down, passed to me, then blocked. I would sit and look at the access log to see if the students were looking at game sites (of the games.yahoo.com type) and block them. When I got wind of this stupidcensorship.org crap, I joined that mailing list (under multiple email address) and started blocking THOSE. The faculty/administration of that school *loved* that they were in control; not the students and not some company with the blocking database. They loved that the software didn't cost them a dime so they were able to pump more money into better back-end hardware.
They didn't believe in locking the machines down with deepfreze (or didn't want to spend the money -- one of the two), but fortunatly for them with how much I had things locked down, the students really haven't been able to damage the machines (as far as software goes). No, they've resorted to damaging hardware (resulting in suspension/expulsion). That is beyond what any ITS individual can prevent.
Re: (Score:2)
Re: (Score:2)
many school in the Sacramento area use it with great success and I myself have deployed it on several machines I oversee at public study-hall areas for apartment complexes in a college town.
Every time the computer reboots it resets itself to how it was when you first installed it, so even if you have no further access prevention (although I would recommend Microsoft's tool which helps you put extra access prevention, just to discourage that sort of behavior) you can
Re: (Score:2)
Jonah Hex
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2, Informative)
it can:
freeze
unfreeze
freeze after x reboots.
needless to say my computer had mozilla and winamp on it. jealousy ensued.
just pointing out that deep freeze isn't flawless either
Agreed (Score:2)
Then, create you user, and move his/her "Application Data" "Templates" "My Favorites" and "My Documents" to a new area
Re: (Score:2)
Better: Deep Freeze plus additional stuff (Score:3, Insightful)
FWIW, I've worked as a school site technician in 3 different school districts and I'm currently a Network Specialist for the local County Superintendent of Schools. I, too, have used and highly recommend Deep Freeze, but it sounds like the person who submitted the question should probably implement some other ways to lock down the computers in addition to Deep Freeze.
If y
Install Linux (Score:2, Insightful)
Two words: (Score:2)
Re: (Score:2)
Excuse me? What kind of employer would assume that a student who knows how to operate LINUX, is computer illiterate? If anything, they'll think the kid is some kind of computer genius.
I call FUD.
Re: (Score:2)
He's right.
Backup Software (Score:4, Insightful)
You're going to hear a lot of "install Linux" comments and a lot of "linux sucks" comments in reply to them. I'm not going to go there. Assuming you're looking for some minimal security, not a whole architecture revamp, look into some good backup software, make a clean install image with everything you want on it, add a network storage server (Linux?) for persistent data, and just periodically wipe the machines and replace them with a known good image. Keep the image up to date, virus scan the network storage, and you're probably going to be fine.
Re: (Score:2)
Re: (Score:2)
A Knoppix boot cd and the 'dd' utility makes that a snap.
This is a bad idea (Score:2)
Re: (Score:2)
I would have modded this as "funny" but some days it is hard to tell, especially when the coffee is all gone.
XP security (Score:4, Interesting)
reimage each machine every night.
Make sure they are on a differnent subnet from all of the admin computers and that the only path to the admin computers from the labs is down through a router.
Files must be stored on a locked down server. Or students own USB drives.
Otherwise. Remove all the hard drives. Lock the door and update resume.
Re: (Score:2)
It tends to reduce the resale value, but it does cut down on a lot of nonsense.
Security (Score:4, Funny)
One word: Don't (Score:5, Interesting)
What I would do is try to create a network disk image that could be quickly and easily reverted to when the machines inevitably get messed up. Let the students play and learn, a large part of learning is in messing things up and trying to fix them.
Re: (Score:2)
Re: (Score:2)
Not really. A school is almost exactly like a business, employees and kids both have to agree to an Acceptable Use Policy (AUP) and that is that.
The main difference is that a school is liable, for things that happen on the network, in ways that a business is not.
The IT guy want kids to use the computers for educatio
Re: (Score:2)
Not exactly, as only half the kids at a school network are looking at porn and playing games, compared to 80% of employees...
But your other point, that a business is not liable for what happens on the network is incorrect. A male employee checks out porn, offense a female, the company is liable for sexual harassment. Your computers get infected and start spewing out spam, you are liable and your T1 shut down for a while. You run a server that accepts
Re: (Score:2)
Except it's run by the state (not a private enterprise), and is mandatory (not optional). Other than that, it's exactly like a busuiness!
It can't be done anyway. (Score:5, Insightful)
No matter what you do, sufficiently motivated students will hack their way around it. At least, that was my experience in high school. It doesn't even matter if you try stuff like BIOS passwords, etc. -- the students have physical access to the machines, or at least can con the teachers into getting it (e.g. in order to fix a problem, unless you've got a much less understaffed IT department than my school had).
So what's the solution? Give up, and let them do it. Re-image the machines if they get screwed up, discipline the students if they do something unacceptable (e.g. download porn, etc.), and don't waste your time bothering with anything else.
Re: (Score:3, Informative)
My experience is that the sufficiently motivated students (me and a few others) didn't actually want to play games or anything...so one answer is to allow only the sufficiently motivated students to get past it (not explicitly open it) but threaten them with discipline if they tell others.
And yes, any machine with physical access is inherently insecure. That isn't necessarily a bad thing, if you plan your security model around that. MIT gives out the root
Re: (Score:2)
If this class is about learning computers, I would teach them computers. If they screw up the operating system or break something, teach them how to fix it. Teach them how to re-image the drive or use the rollback feature.
If we hide knowledge we aren't teaching our kids anything.
If they do something bad then punish them, but don't treat them like criminals when they are here to learn.
No it isn't (Score:2)
Lock them down and lock the cases shut.
Re: (Score:2)
Re: (Score:3, Funny)
I think what you're trying to say is...that you screwed around with school computers during English class?
Re: (Score:2)
Image the machines (Score:2)
Get a domain controller and follow these policies (Score:4, Informative)
This is the only way I've found to keep people from messing up Windows Machines.
Shared Computer Toolkit WDP (Score:3, Informative)
Re:Shared Computer Toolkit WDP WGA (Score:2)
SCT + gparted = crazy delicious (Score:3, Informative)
Deep Freeze (Score:2, Informative)
Reinstall and lock down (Score:2)
Next create one or multiple student accounts, possibly one for each student so it can be traced, and lock it down. By that I mean take away write access to c:\,c:\windows,c:\windows\system32\ most program files folders etc. In short, they should only be able to write to their desktops, and other profile folders. If they cause a mess just delete the profile folder and let them login to recreate it.
Apart from th
Don't go too far... (Score:2)
Deep Freeze a great solution (Score:5, Informative)
Now, if you want to further limit what they can do, you can make many changes to the registry in windows to block users from doing many things such as using the "run" menu, installing applications or a number of other things as simple as changing screen resolution or color depth. Once you set everything up and create the image of your restricted setup, Deep Freeze will maintain it every time for you.
You can get Deep Freeze from here: http://www.faronics.com/ [faronics.com] or look there to find out more information about how it works.
We have tried other products in the past that claimed to "restrict" Windows such that users could not make harmful changes (e.g. OnGuard) but none of the ones we utilized were able to be fool-proof and stop students from getting around it or messing something up. Short of reformatting the machine Deep Freeze is pretty hard for the student to get around. Thawing the machine to make changes requires a lengthy key combination to even bring up the password box (key combination is customizeable by you), or you can enter a key combination on bootup to access the password box to thaw the machine. You can also maintain the systems through a Deep Freeze console so you can admin all the machines at once and even push new images to them that way.
That's my three cents on how we do things in an Academic environment, but our general policy has been slight restrictions but allow them a lot of free reign - except we reset the system every time it is rebooted. I'd suggest for Middle and High school to implement a lot more restrictions on the base image that you use with Deep Freeze than what we have here at the University level.
Mod parent up (Score:2)
I've seen extensive deep freeze deployment starting from when I was in high school and continuing through higher education. I work in a computer lab now, and that is what they use; I've seen the software in action and have also done some light administration with it.
From what I can tell, it basically makes the system invincible. It doesn't matter what weird crap the students pull on our machines (and trust me, young students can destroy any system they touch in no time, guaranteed--you have no idea how u
Re: (Score:2)
I found it a good tool, but like everything else it isn't invulnerable to different attack vectors (physical). I'd recomend this in combination with other solutions like off-computer imaging solutions for times when the tool is compromized and firewalls just because you should always use 'physical'
Re: (Score:2)
Good luck!
couple of quick things to do (Score:2)
second, remove the run command from the start menu through group policy.
third, disable the hot keys for run.
fourth, make the password for the admin account 15 characters long so the usual password hash rainbow tables won't be able to insta crack it.
password protect the bios so that the smart kids can't change the boot order to boot from usb. that'll prevent them from getting the sam files.
make an image and store it.
Easy (Score:2, Troll)
Re: (Score:2)
Well, speaking from experience... (Score:4, Insightful)
First, lockdown all accounts. Some people mentioned Deep Freeze, some people mentioned group policy. My old school used Active Directory with group policies, so yearbook students and teachers could save files to the central server.
Take away the Task Manager, right-click, and Internet Explorer. Those are the most common amateur attack vectors. I'm at Oregon State University, and have had no problems compromising the "locked" computers here simply because they left me with Internet Explorer. Replace it with Firefox, and read the Firefox docs on how to lockdown the browser settings.
Tell teachers to supervise kids in computer labs. There was one lab at my old school which kids stole drives, memory, and fans from all the time simply because the teacher in that lab was incapable of monitoring his students. It was bemusing but also expensive.
Re: (Score:2)
Tell teachers to supervise kids in computer labs. There was one lab at my old school which kids stole drives, memory, and fans from all the time simply because the teacher in that lab was incapable of monitoring his students. It was bemusing but also expensive.
I was in a university lab with the old Powermac G3 towers shortly after they were introduced. I don't know if you've ever seen them, but there was a handle on the side to open them. No screws, no tools needed, the side just hinged down taking half t
Get some hackers (Score:2, Insightful)
A few Suggestions (Score:2)
2. True limited user accounts where the students have only User level rights. Make accounts individual per user, you'll need a domain controller if there is not already one to accomplish this however. (Depending on scope you might be able to rededicate one of the machines as a DC)
3. Force password changes on a monthly basis, to help stop the passing around of passwords.
4. Secure the Domain Admin account, a good idea is share the account between two users, each with only
Lock it down hard (Score:4, Informative)
Most of the student won't try to break things, but a few assholes will so you have to make sure they can do the least amount of damage possible. Unless, of course, you feel like cleaning things up daily.
You could also get an Active Directory domain and push the restrictions that way. I prefer to script it since I prefer to have my servers run Linux.
possibly redundant suggestion (Score:2)
HD space is cheaper now, so you might be able to get away with a hidden partition for re-imaging. Problem is, what if they modify the hidden partition with something malicious?
As for
two suggestions (Score:3, Interesting)
Second: install VNC as a service on all the machines, with a good password, and configured to not allow keyboard/mouse control. Then switch all students to non-administrator access so they can't turn it off (stop the service) or uninstall it. Finally, announce to each and every class that you have the capability to watch any desktop at any time remotely, and will basically be scanning through every desktop in the room regularly and punishing everyone caught doing stuff they shouldn't. Then DO IT, until the message sinks in that you're serious.
Third: over time, do consider switching to a more secure OS, provided it can support what you're trying to accomplish in the lab.
Turn everything off (Score:2, Troll)
4 years IT support for Public Schools (Score:3, Insightful)
Anyway as far as locking the system down, if you own Windows 2000/2003 server Active directory is the easiest and cheapest way to go. It will take some tweaking but it works pretty well. I also found striking the fear of god into the kids was equally effective.
And the guy who posted about the stock of mice and keyboards, he is also right on! They run through that equipment like water! So you strike a good deal with a vendor and buy those things in bulk. We got the keyboards down to like 7 bucks ea. and the mice about 3-4 bucks each.
Group policies are your friend (Score:5, Informative)
VLAN your network. If you have Cisco switches, this should be easy. Set up seperate VLANs for students, the staff, and servers. You'll be able to isolate what resources can be accessed based upon these access lists.
SET UP A PROXY SERVER! Seriously. One of the first systems you should implement is ISA Server 2006. ISA Server will act as an internal proxy to control what users have access to the Internet, and what resources they can access. Set ACLs on your internal switches to prevent routes to the Internet from the student VLAN unless they go through the ISA Server. Set up the ISA Server in front of a filtering appliance, pass all HTTP traffic, and allow access only to HTTPS sites you've added to an allow rule on your ISA server. Add the same limits to SWF, DCR, and possibly java or class files.
Only allow Internet traffic to port 80 and (to a limited extent) 443 for students: Look, your students aren't going to need any other services besides HTTP and HTTPS, and if you're not careful about HTTPS, they'll be popping holes in your proxy using an encrypted web service.
Set your web filtering to deny unrated sites: Students are going to try and circumvent your web filter though phproxy or cgiproxy. The smartest kids will go so far as to set up their own domain to get around your filter. The solution? Block what's not rated. It's also important that your filter have a mechanism to request that a site be unblocked. From a security perspective, it's important that you not open yourself up to risks that you can't control - including websites - but it's also important for the students' development that they have an opportunity to view controversial subjects and make up their own minds about the topic.
Use groups: Set up an OU for each grade in your school. Create a global domain group for each grade. Set up another OU for classes, and create a global security group for each class section. That way, you'll be able to allow or deny access to resources for each grade or class.
Software Restriction Policies: If you have a Server 2003 network, group policies are an amazing asset for your Windows XP clients. Group policies allow you to change settings on users and computers in your network. For instance, you can disable access to the registry or lock down Internet Explorer. Within group policies are a special policy component called Software Restriction Policies that allow you to decide whether or not applications can run based upon the hash, path, or filename. On my network, I designed the SRP around hashes. Managing those policies was a pain (the list was around 400 executables), but it was worth limiting what code would execute on the systems.
Admin tools: You'll want to turn off access to all administrative tools, so disable access to the command prompt, registry editor, and MMC. Also, disable access to the security tab in Explorer to prevent students from changing file permissions. For your computer policies, set the local security policy to disable storing the LM hash for passwords.
Use the Windows firewall: I know it's not much, but it does provide a lot of benefit over nothing at all. Using group policies, configure static rules into the Windows firewall. This will prevent malware from causing problems on your network, and will also prevent iTunes from eating your bandwidth.
Web browsers: It pains me to say this, but don't allow browsers other than Internet Explorer to run on your machines during school. When Firefox adds group policy support, I'll relent on that, but you have no control over what code is executed in Firefox, whereas group policies give you a lot more control over Internet Explorer. Example: after implementing our software restriction policies, students began downloading Flash games in swf form to their laptop hard drives. After receiving complaints from teachers, we simply disabled Firefox through SRPs, and disable
ADS Security and Ghostcast (Score:3, Informative)
* It's relatively simple to lock down users with GPO where all they see is a start menu and specifically what you want to give them. Make sure you remove access to the C: drive. Be warned that there are ways around it so keep you eyes open.
* If you MUST give them net access, force proxy and restrict the hell out of them. Teenagers will look at stuff they're not supposed to and are very creative at getting around firewalls
* Get ghostcast, or opforce, or something free and reimage them every night. You'll thank me later.
* There'll be one or two kids (usually just one) that always manage to get around your restrictions. These are the kids that will one day have hugely successful IT careers. My experience is it's better to give them some extra responsibility to help YOU out, they'll thank you for it.
Don't lock them down, let them do it (Score:3, Interesting)
Re: (Score:2)
Sure. (Score:5, Interesting)
These machines will NOT run most of the applications you have at home. We want it that way.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2, Interesting)
It's so convincing, it even took me a few seconds to realize that it wasn't XP. (When I looked at the Start menu and saw an X instead of a Windows logo. Everything else on screen would have been 100% 'at home' on a true Windows computer.)
Re: (Score:2)
If you want to go to the effort, you can even customise a setup like this, then create
Re: (Score:2)
Yeah like mozilla & openoffice are so diffent to the windows equiv's. I'll take years to show them that the back button in mozilla works just like errr. the back button on IE, and open office how long will it take to show people that to open a file you select File/Open unlike microsoft office where you select errr file/open!
Re: (Score:3, Interesting)
That's what they use at his middle school, and they use both Windows and Linux. When I installed Linux dual-boot on his home PC (P4 3.2 GHz, 512 MB RAM,) the only way he knows he's in Linux is that he can't find his games.
Your troll would be interesting, if there was fact behind it.
Re: (Score:3, Informative)
Re:An Idea... (Score:5, Insightful)
Basic web usage is portable to Internet Explorer (and even moreso to Firefox on Windows). Basic word processing skills can be easily transferred from OpenOffice to MSOffice. Basic fragging skills are transferrable from Quake 3 to Half-Life (c'mon, these are high school students).
More important, learning to accomplish the same task using more than one application can really help cement in the kids' minds that they're not learning "how computers work," but "how this particular application works." Which is very important for a real understanding of computers. Where differences exist, they open up opportunities for learning. What is a file format? How can multiple programs handle the same data, and why do they sometimes do it slightly differently? What are web standards?
Couple that with the number of programming languages freely available to educational institutions under the apt-get license, and it seems to me that there is definitely a place for Linux in the classroom.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
my 2 cents
Re: (Score:2, Insightful)