A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

5
votes
2answers
355 views

Advice for writing my first application security review

I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
12
votes
5answers
5k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
5
votes
3answers
521 views

How to respond to attack made from my dedicated server?

There was a sudden unusual peak of outbound traffic from my hosted dedicated server (OS - Windows Server 2008 R2). The hoster threatened to block the server if the problem is not solved. There are an ...
9
votes
3answers
8k views

Security of passwords remembered by Windows

Does Windows XP or Windows 7 encrypt saved passwords? I'm assuming that the user uses local password to logon. The user then uses his own computer to connect to server in work and sets the "remember ...
5
votes
1answer
2k views

What are the security implications of enabling WINRM on all domain members?

As Powershell becomes more and more popular, it appears that using WINRM may end up being a better option than using PSEXEC from SysInternals for remote management. Given that WINRM is disabled by ...
-2
votes
11answers
4k views

Do we really need an antivirus? if yes, what for? And how do they activate and enter in a PC?

I've been reading on various sites how PC get infected by viruses and I got: Email attachments (but of course, only if I get an exe and open or execute something, right?) Don't update windows ...
2
votes
2answers
428 views

Security Risks Involved in Deploying Win Server 2008 on a Linux host

The Question: Are there any major security risks I should be concerned about, caused by installing Windows Server 2008 R2 onto a Linux Host in VirtualBox? I run an Ubuntu box, with a fully-secured ...
6
votes
2answers
2k views

How secure is isolated storage on Windows?

I am using Isolated Storage with the following flags: IsolatedStorageScope.User |IsolatedStorageScope.Domain | IsolatedStorageScope.Assembly How much security will this provide? Are there any ...
3
votes
3answers
1k views

Need to secure (and add SSL?) RPC port 443 on Win2003 server

So I received an email from my system administrator who wants me to secure a server I own that seems to have a vulnerability in port 443 (which is Windows RPC over HTTPS). Disabling it I know causes ...
5
votes
3answers
407 views

What are the security considerations for setting up a basic security testing environment?

I only have 2 spare machines and both are very old, but I really want to set up an environment so that I can start practicing security. One of these machines has a Pentium 4 processor and 512 MB RAM; ...
3
votes
2answers
1k views

SIEM and Windows Event Logs

When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...
12
votes
4answers
615 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
19
votes
3answers
2k views

Can Windows malware harm a Linux computer when it's executed with Wine?

I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables. I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
14
votes
4answers
4k views

Three-Factor Authentication for Windows

This HowToGeek article... http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/ ...got me thinking. Is there any software (or combination of software) that ...
14
votes
2answers
4k views

Hiding user account names from unauthenticated RDP sessions

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
13
votes
3answers
32k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
4
votes
1answer
4k views

Windows task manager can see all processes as non administrator without permission

On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
1
vote
1answer
522 views

Firefox Desktop Shortcut Being Renamed

On my Vista PC the Firefox shortcut icon is being randomly renamed. The name changes to some variation of a recently visited URL. This unwanted action has survived several version updates. Of course I ...
10
votes
3answers
1k views

Attacks against windows kiosk software

I am interested in potential/actual attacks against kiosk software. I am not talking about physical access, or specifically designed kiosk operating systems or shells, bur rather software that runs ...
0
votes
1answer
114 views

Windows network specific attacks

I have limited experience with Windows networks and certainly no experience with AD forests or anything related. I have experience and understanding how to secure and maintain a unix style network. ...
5
votes
1answer
266 views

Secure access to a Microsoft Access Database

I have a server set up with medical files in a Access database. I am taking over this job from an existing guy who has vanished, so I don't know all the details of the system. I can find out specific ...
5
votes
2answers
718 views

What are the risks associated with relying on IPSec IP Filtering?

When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox). Because IPSec Filtering is not stateful, ...
6
votes
3answers
3k views

What differences are there between built-in Administrator and other Administrators?

Are there any significant differences in the rights, privileges, permissions, or other powers held by the built-in Administrator account, and those held by non-built-in Administrator accounts?
4
votes
1answer
516 views

Does sandboxie “grab” all the system calls?

Sandboxie: http://www.sandboxie.com Does sandboxie "grab" all the system calls, e.g.: filesystem calls? Or it "grabs" all the low level calls from a process?
25
votes
3answers
19k views

How does the Windows “Secure Desktop” mode work?

Can anyone explain (or provide a link to a simple explanation) of what the Windows "Secure Desktop" mode is and how it works? I just heard about it in the KeePass documentation (KeePass - Enter ...
1
vote
1answer
2k views

RDP vs. VNC when looking them from security side

Regarding: http://unix.stackexchange.com/questions/12924/ssh-tunnel-with-vnc Which one would be better, if we look it @security side? I heard that RDP is very very poor when it comes to security.
3
votes
1answer
149 views

Security track record of SSHD on Windows machines?

How do the various SSH daemons that run on Windows compare in terms of security? Vulnerabilities found, reviews by respected reviewers, source code availability, etc. I only need access to a cmd ...
7
votes
2answers
730 views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
5
votes
2answers
1k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
10
votes
5answers
7k views

Encrypting files in a windows environment

We have certain client data which must be encrypted at all times. The part we have been struggling with is encrypting files on network shares. Currently we have network folders encrypted using PGP ...
2
votes
2answers
7k views

aircrack-ng under Win7 — possible?

What needs to be installed to get the full aircrack-ng suite (or the closest possible equivalent) working under Win7? Should you use VirtualPC, VirtualBox, or VMware Workstation for this? Should you ...
5
votes
2answers
330 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
4
votes
1answer
679 views

Security Risk of Disabling forceguest in non-AD Environment

Our application group is looking to deploy a product which requires that we disable forceguest in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. We are running on a Novell network (I know, I ...
4
votes
2answers
694 views

how unsafe is it for Windows webserver IIS to have domain privileges

Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. ...
15
votes
3answers
897 views

Starting with sandbox development

I am looking for some security related project in which I can contribute and also learn something. Since I am new with this stuff It will be better if that project is less complex and digestible for a ...
5
votes
3answers
852 views

Windows Honeypot user account for tracking laptop

I've been wanting to create a dummy "Honeypot" user account on my Windows 7 laptop in case of theft. My question is: Has anyone come across useful resources and tips for doing this? Is there a way ...
3
votes
2answers
349 views

Setup and record outbound traffic from a botnet in a sandbox/secure environment

How do I record the outbound 'attack' traffic from a botnet on a Windows XP machine? The captured traffic will be in the Windows XP firewall log. I need to setup some kind of an experiment where I ...
6
votes
1answer
6k views

Download Windows 7 security updates and patch offline

I am planning to do a clean Windows 7 OS installation. Is it possible (and/or recommendable) to download all the Windows 7 Security Updates from Microsoft in advance and patch my fresh Windows 7 ...
8
votes
4answers
893 views

Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?

If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)? Or are there known vulnerabilities that may cause infection?
8
votes
2answers
569 views

How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?

From NIST SP 800-53, Rev. 3: SC-10 NETWORK DISCONNECT Control: The information system terminates the network connection associated with a communications session at the end of the session or ...
11
votes
3answers
3k views

How can I prevent someone from accessing a Windows XP system via boot disk?

Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one: ...
1
vote
1answer
308 views

Effectiveness of Belarc Advisor

I have seen some people recommend Belarc Advisor for Windows hardening, especially for servers. It's supposed to check for stuff such as installed hotfixes and CIS benchmarks (<-- which are great, ...
0
votes
2answers
7k views

Replacing windows shell for everybody but the system administrator

[cross posted from superuser - I believe the question is also relevant here] I'm trying to harden a windows 7 machine, including replacing the default login shell from explorer.exe to a custom ...
9
votes
3answers
2k views

How can I mitigate the threat that DPAPick poses to my DPAPI protected data?

The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications). DPAPick was presented at BlackHat ...
8
votes
4answers
775 views

How to track a laptop after theft?

Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible. ...
2
votes
1answer
152 views

Whitelisting applications in Windows7

Windows 7 and Server 2008 R2 come with a security tool called Applocker. This allows admins to restrict applications to a specific white list which can be as granular as the individual application ...
7
votes
5answers
934 views

How can I secure a network share from the insider threat?

We have a network share that contains thousands of files. I am concerned that anyone with access to the internet could copy that information to a CD. In addition to disabling all removable media, ...
2
votes
1answer
475 views

Is 2008 Server Core installation the most secure deployment?

In a Windows environment where security is more important than flexibility is Windows 2008 R2 Core Server installation the best option? How much more difficult is it to setup an environment with ...
6
votes
1answer
2k views

How do I apply a security baseline to Windows 2008 R2?

I've setup a Windows 2008 R2 server with an Active Directory Domain Services role. I would like to apply the Specialized Security – Limited Functionality (SSLF) security baseline to it, but am unsure ...
17
votes
4answers
4k views

Windows hardening

Can anyone point me at some good resources on Windows hardening? From 2003 upwards.