windowswideopen.com

To use enable verbose status messages by editing the registry, follow these steps:

Note Windows does not display status messages if the following key is present and the value is set to 1:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableStatusMessages

verbose status message Windows Windows 2000 Windows XPverbose status message Windows Windows 2000 Windows XP

No Comments »
Filed under: Windows XP, Windows 2000

Remote Installation Service Installations

The process of adding OEM Plug and Play drivers to RIS installations involves the same steps that are listed in the “Unattended Setup” section of this article, with two small adjustments:
1. Place the $oem$ folder at the same level as the \I386 folder of the RIS image. For example:

RemoteInstall\Setup\%language\Images\%dir_name%\i386
RemoteInstall\Setup\%language\Images\%dir_name%\$oem$\$1\Drivers
\NIC
\MODEM
\VIDEO

2. Modify the RIS image default template (Ristndrd.sif). In the [Unattended] section, change the OemPreinstall = key value from No to Yes, and then add the OemPnPDriversPath = Driver_Path entries. You can list multiple paths in this key by separating them with a semicolon (;), as follows:

[Unattended]
OemPreinstall = Yes
OemPnPDriversPath = Drivers\NIC;Drivers\Modem;Drivers\Video

Note The %SystemDrive% environment variable string is automatically inserted before each of the listed search paths.

Note If one of the OEM-supplied drivers is for a network card device, the RIS server must have this file available when you boot into text-mode Setup.

For additional information about this process, click the article number below to view the article in the Microsoft Knowledge Base:
315279 (http://support.microsoft.com/kb/315279/EN-US/) How to Add a Third-Party OEM Network Adapter to an RIS Installation
3. Stop and then restart the BINL service on the RIS server. To do this, type the following commands at the command prompt, pressing ENTER after each one:
net stop “boot information negotiation layer”
net start “boot information negotiation layer”
ADS Operating System Windows XPADS Operating System Windows XP

No Comments »
Filed under: Operating System, ADS, Windows XP

1. Start -> Run -> type Regedit
2. Click on File, then choose “Connect Network Registry”.
3. In the Select Computer search box either browse Active Directory to locate the remote server, or type its name in the dialog box.
4. In the remote machine’s registry navigate to the following key: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
5. Under the Terminal Server key locate the value named fDenyTSConnection (REG_DWORD).
   
6. Change the value data from 1 (Remote Desktop disabled) to 0 (Remote Desktop enabled).
7. Click OK and close Regedit.
8. Changes should take effect without a reboot but to be sure type ’shutdown -m \\srv1 -r” at a CMD prompt
9. Test connection
   

Terminal Services Windows XPTerminal Services Windows XP

No Comments »
Filed under: Windows XP, Terminal Services

If you find that your desktop icons are corrupted/ garbled, wrong images appear or suffering from frequent redraws then you may need to increase the size of yoru icon cache. To increase the icon cache file (C:\Documents and Settings\Your User Name\Local Settings\Application Data\Iconcache.db) size

System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
Value Name: Max Cached Icons
Data Type: REG_SZ (String Value)
Value Data: 100 - 4096 (default = 500) .

Consider modifying these registry keys as well:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\IconCache]

"Text"="Icon Cache Size"
"Type"="group"
"Bitmap"="SHDOC401.DLL,6"
"HelpID"="update.hlp#51140"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionexplorerAdvancedIconCacheSmall]
"RegPath"="SoftwareMicrosoftWindowsCurrentVersionExplorer"
"Text"="1024 Icons"
"Type"="radio"
"CheckedValue"="1024"
"ValueName"="Max Cached Icons"
"DefaultValue"="2048"
"HKeyRoot"=dword:80000002
"HelpID"="update.hlp#51140"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionexplorerAdvancedIconCacheMedium]
"RegPath"="SoftwareMicrosoftWindowsCurrentVersionExplorer"
"Text"="2048 Icons"
"Type"="radio"
"CheckedValue"="2048"
"ValueName"="Max Cached Icons"
"DefaultValue"="2048"
"HKeyRoot"=dword:80000002
"HelpID"="update.hlp#51140"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionexplorerAdvancedIconCacheLarge]
"RegPath"="SoftwareMicrosoftWindowsCurrentVersionExplorer"
"Text"="4096 Icons"
"Type"="radio"
"CheckedValue"="4096"
"ValueName"="Max Cached Icons"
"DefaultValue"="2048"
"HKeyRoot"=dword:80000002
"HelpID"="update.hlp#51140"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionexplorerAdvancedIconCacheHuge]
"RegPath"="SoftwareMicrosoftWindowsCurrentVersionExplorer"
"Text"="8192 Icons"
"Type"="radio"
"CheckedValue"="8192"
"ValueName"="Max Cached Icons"
"DefaultValue"="2048"
"HKeyRoot"=dword:80000002
"HelpID"="update.hlp#51140"

Operating System Windows XPOperating System Windows XP

No Comments »
Filed under: Operating System, Windows XP

If you have a stand alone networked Windows Xp computer then it is likely exposed to all manner of threats such as hackers, viruses and malware. The following tips will provide a defense wall against some of these threats:

1. Ensure that you keep up to date with the latest Microsoft security bulletins (http://www.microsoft.com/technet/security/current.aspx), hotfixes and Windows updates.
2. Verify that all harddisk partitions are formatted with NTFS
3. Delete or disable all non-required local accounts
4. Protect the Registry from Anonymous access
   The default permissions do not restrict remote access to the registry. Only administrators should have remote access to the registry, because the registry editing tools support remote access by default. To restrict network access to the registry:
   Add the following key to the registry:
   1. Open the registry editor in 32 bit mode with the command “regedt32”
   2. Hive
   3. HKEY_LOCAL_MACHINE \SYSTEM
   4. Key
   5. \CurrentControlSet\Control\SecurePipeServers
   6. Value Name
   7. \winreg
   8. Select winreg, click the Security menu, and then click Permissions.
   9. Set the Administrators permission to Full Control, make sure no other users or groups are listed, and then click OK
5. Set Strong Password Values
   Use the Local Security Policy snap-in (gpedit.msc from Start -> Run) to strengthen the system policies for password acceptance. Microsoft suggests that you make the following changes:
   1. Set the minimum password length to at least 10 characters
   2. Set a minimum password age appropriate to your network (typically between 1 and 7 days)
   3. Set a maximum password age appropriate to your network (typically no more than 45 days)
   4. Set a password history maintenance (using the “Remember passwords” option) of at least 5
6. Rename the Administrator’s account
   • Establish a decoy account named “Administrator” with no privileges. Scan the security event log regularly looking for attempts to use this account.
7. Set up the audit policies:
   Go to Administrative Tools\Local Policies\Audit Policy
   Set:
   • Audit account logon events to Success/Failure
   • Audit account management to Success/Failure
   • Audit directory service access to Success/Failure
   • Audit logon events to Success/Failure
   • Audit object access to Success/Failure
   • Audit policy change to Success/Failure
   • Audit privilege use to Success/Failure
   • Audit system events to Success/Failure
8. Set User rights Assignment Policies: Go to Administrative Tools\Local Policies\User Rights Assignment Set:
   • Access this computer from the network to: Administrators, Authenticated Users
   • Act as part of the Operating System: Revoke all security groups and accounts
   • Add workstation to domains: Administrators
   • Allow log on locally: Administrators, Backup Operators
   • Allow log on through Terminal Services: Administrators
   • Change the system time: Administrators
   • Debug programs: Revoke all security groups and accounts
   • Deny access to this computer from the network: Anonymous Logon, Built-in Administrator, Guests, all
   • Deny log on as batch job: Guests, Guest
   • Deny log on through Terminal Services: Built-in Administrator, Guests, all Non-operating System service accounts, Guest
   • Enable computer and user accounts to be trusted for delegation: Revoke all security groups and accounts
   • Impersonate a client after authentication: Local Service, Network Service
   • Lock pages in memory: Administrators
   • Log on as batch job: Revoke all security groups and accounts
   • Profile single process: Administrators
   • Restore files and directories: Administrators (unless this is a backup server)
   • Shut down the system: Administrators
   • Synchronize directory service data: Revoke all security groups and accounts
9. Set Security options policy Go to Administrative Tools\Local Policies\Security Options
10. Set:
    • Devices: Restrict CD-Rom access to locally logged-on user only: Administrators
    • Devices: Restrict floppy access to locally logged-on user only: Administrators
    • Domain Controller: Allow server operators to schedule tasks: Disabled
    • Domain Controller: Refuse machine account password changes: Disabled
    • Domain member: Require strong (Windows 2000 or later) session key: Enabled
    • Interactive logon: Do not display last user name: Enabled
    • Interactive logon: Message title for users attempting to log on:
    • Interactive logon: Number of previous logons to cache: 0
    • Interactive logon: Require Domain controller authentication to unlock workstation: Enabled
    • Microsoft Network client: Digitally sign communications (Always): Enabled
    • Microsoft Network Server: Digitally sign communications (Always): Enabled
    • Microsoft Network Server: Digitally sign communications (If client agrees): Enabled
    • Network access: Do not allow anonymous enumeration of SAM accounts and shares: Enabled
    • Network Access: Do not allow storage of credentials or .Net passports for network authentication: Enabled
    • Network access: Named Pipes that can be accessed anonymously: None
    • Network access: Shares that can be accessed anonymously: None
    • Network access: Do not store LAN Manager hash value on next password change: Enabled
    • Network security: Minimum session security for NTLM SSP based (including secure RPC) clients: Enable all settings
    • Network security: Minimum session security for NTLM SSP based (including secure RPC) servers: Enable all settings
    • System Objects: Default owner for objects created by members of the Administrators group: Object Creator
    • System settings: Optional subsystems: None
11. Install reputable Antivirus software and update virus definitions daily
12. Install firewall sofware or configure to allow only needed ports/applications network access
13. Apply the following registry keys (note ensure that you make backup of the keys before proceeding:
14. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\
    Security Consideration for Network Attacks
    Subkey RegistryValue Entry Format Value
    EnableICMPRedirect DWORD 0
    SynAttackProtect DWORD 1
    EnableDeadGWDetect DWORD 0
    EnablePMTUDiscovery DWORD 0
    KeepAliveTime DWORD 300,000
    DisableIPSourceRouting DWORD 2
    TcpMaxConnectResponseRetransmissions DWORD 2
    TcpMaxDataRetransmissions DWORD 3
    PerformRouterDiscovery DWORD 0
    TCPMaxPortsExhausted DWORD 5=========================================================================HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\
    Explorer\AFD.SYS Settings
    Subkey RegistryValue Entry Format Value
    DynamicBacklogGrowthDelta DWORD 10
    EnableDynamicBacklog DWORD 1
    MinimumDynamicBacklog DWORD 20
    MaximumDynamicBacklog DWORD 20000

    Disable Autorun: Disable Autorun for all drives
    Subkey RegistryValue Entry Format Value
    NoDriveTypeAutoRun DWORD 0xFF

    =========================================================================
    HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\

    Make Screensaver Password Protection Immediate: The
    time in seconds before the screen saver grace period
    expires (0 recommended)
    Subkey RegistryValue Entry Format Value
    ScreenSaverGracePeriod String 0

    =========================================================================

    HKEY_LOCAL_MACHINE\ SYSTEM\CurrentControlSet\Services\Eventlog\Security\

    Security Log Near Capacity Warning: Percentage threshold
    for the security event log at which the system will generate
    a warning
    Subkey RegistryValue Entry Format Value
    WarningLevel DWORD 90

See Also:

Security Windows XPSecurity Windows XP

1 Comment »
Filed under: Windows XP, Security