Permissions and sandboxing in Windows?

R

Robotex2011-02-14 13:28:24

Windows

Robotex, 2011-02-14 13:28:24

I once read here that an antivirus is essentially not needed - it is enough to correctly configure the system and correctly distribute rights. After another fall of the father's system, I seriously thought about it.
So how do you set up windows to behave like Linux? In order not to be afraid of viruses, crooked hands of users, etc.

Reply

Answer the question

In order to leave comments, you need to log in

7 answer(s)

I

Inflame, 2011-02-14
@Inflame

The bottom line is to prohibit the launch of programs from where there are write permissions, and allow the launch where it is impossible to write.
1. Create a user in the "Users" group.
2. Next, Control Panel → Administrative Tools → Software Restriction Policies → Additional Rules. Add rules with a ban on drives C: and D: (if any), allow Program Files, Windows, system32. You can also disable flash drives.
3. For convenience, so that you can launch programs by shortcuts, remove shortcuts from the Assigned File Types (located in the Software Restriction Policies). In the same place, you can remove help files, etc. from prohibited files.
You need to install all the software before creating policies. Checked on XP, on the Seven I don’t know how it will work. There may be problems with some software.

S

Sergey, 2011-02-14
@bondbig

Guest + runas. Nothing unusual.

A

agul, 2011-02-14
@agul

Just yesterday a question popped up: http://habrahabr.ru/qa/4761/

D

Dr_Zoidberg, 2011-02-14
@Dr_Zoidberg

hmm, in Windows 7 just don't disable UAC and don't download exe from mail and porn sites

3

3em, 2011-02-14
@3em

a little on the topic was on habré habrahabr.ru/blogs/sysadm/97594/

N

Nicholas, 2011-02-15
@pnick

I'm not sure what suits you, but look towards sandboxes, for example . Super useful stuff.

C

charon, 2011-02-15
@charon

I’m afraid that windows won’t be able to be configured the way Windows is - there are too many people who want to break and the code is too the same everywhere, which simplifies writing exploits.
In addition to the above tips, I recommend installing 64-bit Windows 7. During its development, MS introduced several additional barriers to hackers, which, together with a small prevalence, still serves as a good additional protection.