Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I already know that this can be done on Linux, One can boot to a flash drive that is write protected. Live modify folders can be symlinked to to a swap partition, and this prevents viruses from being stored between reboots. All file storage would be temporary until next reboot, documents could be uploaded to an online service.

My question is about Windows. There are times in our business when it will be necessary to use Windows in order to recreate what is seen by our customers. Short of operating in a Windows VM:

  1. Is there a way to always be booted to a clean state on every boot?

    Or, if this can only be accomplished with a large delay on boot

  2. Is there a way to copy the entire OS to an external (flash) drive, with the ability to boot the the drive and reinstall the image on demand?

  3. Other suggestions would be appreciated. (Perhaps a Virtualization server?)

share|improve this question
    
I know you can clean-slate boot as our university did it on all public PCs but I don't know how. –  Ben Brocka Mar 1 '12 at 15:16
4  
This would probably be better suited to Server Fault, since you've really already answered the security bit of your question by deciding to use a clean windows install every time. The answer, incidentally, is yes, you can do all these things on Windows; if speed is a factor (unlike in Ben's example where the rebuild runs overnight) then virtualization is probably the way to go: most VM products have an easy-to-use feature to quickly roll back to a snapshot of the guest at a particular point in time. –  Graham Hill Mar 1 '12 at 15:21

4 Answers 4

  1. There used to be a Microsoft tool called Windows SteadyState which could be used to do that, but it is unsupported now.

    However, Microsoft provides some alternatives that use Windows 7 technologies: see this document.

    The only downside is that hard drive protection can not be recreated; a workaround could be creating a separate recovery partition and booting to it every time.

  2. Yes, you could use the WAIK, prepare and customize a WinPE USB key, copy a "fresh" Windows 7 image on it and use it as needed to reimage the computer.

(Edit: as @Graham Hill pointed out, it is also possible to create a VM, take a snapshot and revert to it at every boot.)

share|improve this answer
    
Bad link for the Windows7 technologies document –  makerofthings7 Mar 1 '12 at 15:42
    
Strange - works for me using Firefox 10.0.2. I'm typing it again: technet.microsoft.com/en-us/library/gg176676(v=ws.10).aspx –  elgaton Mar 2 '12 at 7:30
    
Both links work for me on all browsers... perhaps MSFT updated something. (before I was redirected to a MSFT 404 page) –  makerofthings7 Mar 2 '12 at 14:23

You should consider BartPE (based on WindowsPE) and the upcoming Windows 8 Windows to Go

share|improve this answer

There are three approaches in general.

  1. You can overwrite the hard disk with an image file.
  2. You can do a silent install of Windows every time
  3. you can use VM snapshots

The image file is easy to do, but the problem is that you have to rebuild the image every time there's a new patch or other change to how you want the machine set up.

The silent install is more complicated to set up, but easier to change once it's done to add patches and so on - you just change the silent install config file, drop patches into a folder, that sort of thing.

However both of these involve re-writing the hard disk, so they do take a bit of time. In most use cases - public machines, web cafes, software test facilities, etc. - you can run the rebuild overnight and so the time is unimportant.

Since you are in a hurry, I think virtualization and snapshots is a better choice. With many virtualization products - both client and server - you can press a button and the software takes a snapshot of the current state of the machine. Then you use the VM and whendone just press another button to throw away any changes and revert the machine back to exactly how it was before you started. Patching is easy too; just patch, then take a new snapshot.

A very quick google shows that for example VMWare, VirtualBox, Xen and KVM all have snapshot capabilities, so you should be able to find something that suits you.

share|improve this answer

DeepFreeze "Deep Freeze provides the ultimate workstation protection by creating a “frozen” snapshot of a workstation’s configuration and settings. Each time you restart your machine, Deep Freeze restores your computer to this original “frozen” state."

Prepare the Frozen state by installing needed software, clean it, defrag it and so on. Each time you reboot it will go back to that Frozen state.

The software cost about $36 US dollars per year, not that expensive IMO.

You can install it however you want vmware or on a hard drive.

Note: Because of how deepfreeze works all files (including virus) will be gone on the next reboot. If you need to save certain things you have the option to leaving certian folder unfreezed, or you could just save things on a usb.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.