Administering Windows Vista Security · the Big Surprises by Byron -- Read -- Imperial Library of Trantor

Index

Administering Windows Vista Security—The Big Surprises Introduction How to Keep Vista Security from Giving You a Stroke

Overview Vista Turns Out to Be More Than Just a Pretty Face. Who Knew? Meet the Coauthors What's Inside This Book Stay Up to Date with My Free Newsletter Contacting Us

Chapter 1: Administering Vista Security—The Little Surprises

Restoring the Administrator

Making Your Own Administrator Activating the Administrator Account

Power Users Are Essentially Gone "Run…" Is Off the Start Menu BOOT.INI Is Gone, BCD Is Here

BOOT.INI Review BCD Terminology Creating a Second OS Entry Understanding Vista Boot Manager Identifiers Choosing Timeout and Default OS with bcdedit

Changing the Boot Manager Timeout Changing the Default Boot Manager Entry

Changing an Entry Option Cleaning Up: Deleting OS Entries

"Documents and Settings" Is Gone, Kind Of IPv6 and Network Properties Remote Desktop Gets a Bit More Secure

NTFS and the Registry Are Transaction Based Undelete Comes to Windows for Real!

Changes in Security Options

Changes to Named Pipe Access Changes to Share and Registry Access LM Deemphasized, NTLMv2 Emphasized No More Unsigned Driver Warnings

Encryption News

Vista Includes New Cryptographic Services You Can Encrypt Your Pagefile Offline Files Folders Are Encrypted per User

New Event Viewer

XML Format Comes to Event Viewer Custom Queries Lets You Customize Event Viewer Generating Actions from Events Telling the Event Log Service to Display Messages Forwarding Events from One Computer to Another Subscription Overview

Set Up the Sources Set Up the Collector

Creating an Example Subscription

Step One: Set Up Vista2 for WinRM Step Two: Create the Subscription on Vista1

Troubleshooting Subscription Delays

Adjusting the 15 Minutes Understanding the "Reboot Delay"

Event Forwarding in Workgroups

Step One: Configure WS-Management on Vista2 Step Two: Tell the Collector to Trust the Source Step Three: Test WS-Management Connectivity Step Four: Set Up the Subscription

Chapter 2: Understanding User Account Control (UAC)—"Are You Sure, Mr. Administrator?"

Introducing UAC Why UAC Is Good, after All

UAC Benefits for Users UAC Benefits for Admins UAC as a Transition Tool

An Overview of UAC Digging Deeper into UAC

How Windows Creates the Standard User Token

How Windows Vista Tokens Are Structured

Your "Name": Your Security ID (SID) Your Groups: A SID List Your Privileges: What You Can Do SeWhat? Your Windows Integrity Level

Seeing Your Token Information Summary: From Administrator to Standard User

How to Tell UAC to Use the Administrator Token

Using RunAs to Get an Administrator Token Command Prompt Window Making Elevated Windows Easier to Get To

Keep a High-Power Command Prompt Handy Make Any Icon Automatically Raise the Consent UI Sometimes Elevation Doesn't Work You Can't Get Past the Consent UI

What Tells Windows to Use the Administrator Token

Vista Looks for Installers UAC and the Vista GUI

Vista's "Alertness Warnings" UAC's Clues: Will This Need Elevation?

Vista Requests Elevation if a Manifest Requests It

What Manifests Are and What They Do Examining Manifests Adding a Manifest with a Resource Editor Adding an External Manifest Embedding a Manifest with Manifest Tool Embedding Manifests Can Break Digital Signing

The Program Compatibility Assistant Tells UAC to Elevate Application Compatibility Toolkit "Shims" Tell UAC to Elevate

Reconfiguring User Account Control

Turning UAC On, Off, or in Overdrive Configuring UAC Junior: UAC for the User Side Point: How "Administrator-ish" Must You Be to Get UACed? Excluding the Built-in Administrator Telling UAC to Skip the Heuristics Controlling Secure Desktop

Understanding the Secure Desktop Disabling Secure Desktop Enabling Applications with Secure Desktop

Sign or Go Home: Requiring Signed Applications Working around Apps That Store Data in the Wrong Places The Big Switch: Turning Off UAC Altogether

Will UAC Succeed? Summary

Chapter 3: Help for Those Lame Apps—File and Registry Virtualization

File and Registry Virtualization Basics Seeing File Virtualization in Action File and Registry Virtualization Considerations Which Areas Are Protected and Where They Are Virtualized

How Virtualization Handles Files

File Writes under Virtualization File Reads under Virtualization

How Virtualization Handles the Registry

What Does "Legacy" Mean, Exactly? Seeing Virtualization in Standard Versus Administrative Users Tracking Virtualization A Possible Virtualization Problem Controlling Virtualization The Future of Virtualization Summary

Chapter 4: Understanding Windows Integrity Control

Windows Integrity Control Overview Mandatory Controls Versus Discretionary Controls

The Orange Book C2 Certification and NT C and B: Discretionary Versus Mandatory

Discretionary Access Overview and Terminology

Parts of a Discretionary Access System "Securable Objects": What Discretionary Access Can Protect

Mandatory Access Overview and Terminology

WIC Components

WIC's Six Integrity Levels How Objects Get and Store Integrity Levels: Mandatory Labels

The SACL: It's Not Just for Audits Anymore WIC's Mandatory Labels: Lost in SACE Viewing Object Integrity Levels: Meet chml and icacls

The Tools: icacls and chml Viewing Integrity Levels with chml Viewing Integrity Levels with icacls Decoding Mandatory Labels

Changing Object Integrity Levels

The New "Modify an object label Properties" Privilege Permissions Needed to Change an Integrity Level Changing an Object's Integrity with chml Changing an Object's Integrity with icacls Testing Out WIC's Prime Directive Default Low Integrity Folders

User Integrity Levels

User Integrity Levels Depend Solely on Privileges

Where Users Store Integrity Levels Viewing User Integrity Levels

Process Integrity Levels

How Processes Get Their Integrity Levels Viewing Process Integrity Levels

Seeing Processes in Action

Setting Up Example: Starting a Low Integrity Application Internet Explorer Protected Mode and WIC A Prime Directive Puzzle: WIC and Deletes

Testing File Delete Permissions with icacls Denying File Deletes Is Different from Denying Most Things How Blocking Deletes via WIC Can Fail The Solution: Ensuring That WIC Protects Objects

Using WIC ACEs to Restrict Access Things WIC ACEs Can't Do

You Cannot Apply Mandatory Labels with Group Policy You Cannot Create Standard Permissions That Name Mandatory Labels

A Note on Modifying System Files Dialing Up Custom Labels

Meet SDDL Strings Understanding the Secret Language of Bs: SDDL Label Syntax

The SACL Designator The SACL Flags The SACE Type SACE Flags

No Flags: "Apply It to Me" CI: "Copy This to the Subfolders" OI: "Copy This to the Files" IO: "I Don't Want it, But the Kids Can Have It If They Want" NP: "Okay, the Kids Get It, but Not the Grandkids" ID: "I Didn't Start This, I Only Inherited It"

SACE Rights SACE Trustee: The Integrity Level

Using SDDL Strings to Set Integrity Levels

Summary

Chapter 5: BitLocker—Solving the Laptop Security Problem

Overview The Laptop Security Problem Today BitLocker Drive Encryption—the Overview

BitLocker Components What Is a TPM?

Full Disk Encryption

Encryption Algorithm Key Storage

Authentication or Access Control

Increasing Security with Additional Key Protectors

PINs Startup Keys

Boot Process Validation (Integrity Check)

Enabling BitLocker for the First Time Using BitLocker without a TPM

Summary of Key Protectors

Recovery

Recovery Example 1: Desktop Hardware Failure (Stand-Alone System without a TPM) Recovery Example 2: Laptop Hardware Failure (TPM-based) Recovery Example 3: Lost USB Key (Computer with a TPM) Recovery Example 4: "Found" Laptop Recovery Summary

BitLocker and Active Directory Group Policy Options Managing the TPM and BitLocker in the Enterprise Servicing a BitLocker-Protected Computer Secure Decommissioning Planning for BitLocker Deployment Summary

Chapter 6: Post-Boot Protection—Code Integrity, New Code Signing Rules, and PatchGuard

Address Space Layout Randomization Giving 64-bit More Armor

PatchGuard

Great, PatchGuard Breaks My App: What Do I Do Now? So, You Want to Disable PatchGuard

Code Integrity

What Can Go Wrong?

Troubleshooting Services Troubleshooting Drivers Troubleshooting Windows Components

New Code Signing Rules

What Is Code Signing and Why Does It Matter? ActiveX Controls Protected Media Path Requirements x64 Requirements Getting Down to Business: Code Signing an Application or Driver

Using an Internal CA Using a Commercial CA

Getting Down to Business: Deploying an Application or Driver Signed by a Publisher

Summary

Chapter 7: How Vista Secures Services

Services in Brief Service Control Manager How Vista Toughens Services: Overview Session Separation Reducing Service Privileges

Developers Can Reduce Service Privileges Admins Can Also Reduce Service Privileges Special Case: Multiple Services Needing Different Privileges Reduced Privilege Summary

Service Isolation

How Service Isolation Works Restricting a Service's SID Granting Write Permissions to a Service SID Understanding the sc.exe Restricted SID Commands

Restricting a Service's Network Ports Summary

Index

Symbols and Numbers

Index

I-J

Index

X-Z

List of Figures

Chapter 1: Administering Vista Security—The Little Surprises Chapter 2: Understanding User Account Control (UAC)—"Are You Sure, Mr. Administrator?" Chapter 3: Help for Those Lame Apps—File and Registry Virtualization Chapter 4: Understanding Windows Integrity Control Chapter 5: BitLocker—Solving the Laptop Security Problem Chapter 6: Post-Boot Protection—Code Integrity, New Code Signing Rules, and PatchGuard Chapter 7: How Vista Secures Services

List of Tables

Chapter 4: Understanding Windows Integrity Control Chapter 5: BitLocker—Solving the Laptop Security Problem

← Prev
Back
Next →

← Prev
Back
Next →