A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

13
votes
6answers
16k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
0
votes
2answers
509 views

Is there something like a “Windows Sandbox software Wrapper”? [closed]

I am facing the following problematic: I want people to send me softwares they develop, then I want to share them to other people, in sandboxed mode, that is to say with no need to have a sandbox ...
8
votes
3answers
3k views

Am I protected from USB autorun malware on Windows 7?

As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
2
votes
1answer
812 views

My MP3 file is blocked, but still playable?

My computer is telling me that my MP3 file is blocked: I have no problems playing the song, so I was wondering what exactly does it mean for my MP3 file to be blocked?
8
votes
2answers
970 views

Local File Download vulnerability - What files can be downloaded to potentially compromise a windows system?

On Linux I have a good idea on what files I would like to get ahold of when you are sitting on a regular file download vulnerability. Any file on the entire OS system is accessible for download, which ...
3
votes
4answers
520 views

How do I ensure that my computer is 100% worm-free?

Ok say I have a brand new laptop that was is brand new. Is it true to say that as long as I keep the bluetooth turned off, and I am not connected to the internet, and only copy files that are 100% ...
1
vote
4answers
265 views

What configuration will allow another computer in the internet to probe my computer's ports?

I've just tested my computer with Gibson's port scan test: The test results stated that my system is "uncommon". It also said that my computer deliberately chose not to return. But I did not do any ...
4
votes
4answers
2k views

Is Windows Firewall suitable for running in a production environment?

Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough? I'm running a VPS with Rackspace on their cloud ...
4
votes
2answers
4k views

Recover EFS encrypted folder after wiping system partition

We've recently ran into trouble while reinstalling one of client's desktop computer. Disk was split into two master partitions named C: and D:. We wiped out C: and reinstalled system (Win XP SP2 ...
1
vote
1answer
17k views

Microsoft Windows RPC (135/tcp) security risks

I was running a vulnerability scan against a Windows Server of mine, TCP port 135. I got the following output: By sending a Lookup request to the portmapper TCP 135 it was possible to enumerate ...
3
votes
2answers
189 views

Potentially unsafe files on second hard drive, how to get my files back?

I have my files on a second hard drive (disconnected for now). This drive was connected to a system infected with Virus:W32/Virut. I have formatted my main hard drive and reinstalled Windows XP. Now I ...
1
vote
1answer
682 views

Should Windows 2008 R2 be used as an externally facing DNS name server?

When compared to more traditional DNS name servers, what are the benefits / drawbacks of using a Windows 2008 R2 as a public ns record for a company. What limitations, or security issues would I ...
9
votes
1answer
1k views

How to know the windows security dialog asking for username password is genuine?

I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this I noticed the "->" character in the domain name which usually it auto fills. Also ...
3
votes
3answers
404 views

What ways are there to elevate from a non-priv account to system on windows?

I have a few computers at home on which i hack for fun. Until now google has been able to answer my questions. But now I need your help. What ways are there to elevate from a non-admin user to NT ...
5
votes
1answer
1k views

Should I only disable, but never delete an account from ActiveDirectory?

In the early days of NT4, I would never delete an account from the domain because I would lose the correlation between the SID and username in event logs and all related audit trails. Is this a ...
3
votes
1answer
225 views

What useful security reports can be extracted from a Windows-based machine and its' related logs?

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)? Assuming I can aggregate them into a report what ...
3
votes
1answer
313 views

How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?

I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
3
votes
1answer
1k views

Which Domain Administrator created file X on a Windows 2008 R2-based server?

Someone created a file (web.config) in a location that basically caused IIS to not work. Is there any way I can determine who created this file? The creator/owner says "Domain Administrators". ...
3
votes
1answer
1k views

“Extended Protection” primer and implementation guide to prevent MITM

Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks. Does anyone have a primer (or explanation in plain English) what this feature is, ...
2
votes
1answer
789 views

Minimum credential for WMI parameters Monitoring?

I'm developing a big project to monitor a remote machine's performance parameters like CPU, memory, disk space, and etc. through C# WMI. I want to use the minimum possible credentials to connect the ...
11
votes
7answers
3k views

Can viruses actually inject their code in other processes?

Can a virus really inject its own code into a process so it stays on your computer permantly? The only way to actually remove it is to reinstall your OS. My question is how can it do that without ...
16
votes
1answer
3k views

Something is changing my hosts file without asking

First: I can't find any information on this phenomenon, not anywhere on the net. I don't know which application does it, but something in my Windows 7 Home Premium system (fully updated & legal) ...
3
votes
2answers
215 views

What is multi-path malware?

I would like to know, in malware analysis, what is meant by "multi-path execution". I read this when I encounter the words in malware detection literature related to Control Flow Graph (CFG).
11
votes
3answers
26k views

Monitoring file access on Windows

I need a way to monitor user file access on windows. What I need is: monitoring of user opening, modifying (don't need to know what the changes were, just that a file was modified), copying, pasting ...
5
votes
2answers
381 views

Advice for writing my first application security review

I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
12
votes
5answers
6k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
5
votes
3answers
549 views

How to respond to attack made from my dedicated server?

There was a sudden unusual peak of outbound traffic from my hosted dedicated server (OS - Windows Server 2008 R2). The hoster threatened to block the server if the problem is not solved. There are an ...
9
votes
3answers
9k views

Security of passwords remembered by Windows

Does Windows XP or Windows 7 encrypt saved passwords? I'm assuming that the user uses local password to logon. The user then uses his own computer to connect to server in work and sets the "remember ...
6
votes
1answer
3k views

What are the security implications of enabling WINRM on all domain members?

As Powershell becomes more and more popular, it appears that using WINRM may end up being a better option than using PSEXEC from SysInternals for remote management. Given that WINRM is disabled by ...
-2
votes
11answers
4k views

Do we really need an antivirus? if yes, what for? And how do they activate and enter in a PC?

I've been reading on various sites how PC get infected by viruses and I got: Email attachments (but of course, only if I get an exe and open or execute something, right?) Don't update windows ...
2
votes
2answers
454 views

Security Risks Involved in Deploying Win Server 2008 on a Linux host

The Question: Are there any major security risks I should be concerned about, caused by installing Windows Server 2008 R2 onto a Linux Host in VirtualBox? I run an Ubuntu box, with a fully-secured ...
7
votes
2answers
2k views

How secure is isolated storage on Windows?

I am using Isolated Storage with the following flags: IsolatedStorageScope.User |IsolatedStorageScope.Domain | IsolatedStorageScope.Assembly How much security will this provide? Are there any ...
3
votes
3answers
2k views

Need to secure (and add SSL?) RPC port 443 on Win2003 server

So I received an email from my system administrator who wants me to secure a server I own that seems to have a vulnerability in port 443 (which is Windows RPC over HTTPS). Disabling it I know causes ...
5
votes
3answers
421 views

What are the security considerations for setting up a basic security testing environment?

I only have 2 spare machines and both are very old, but I really want to set up an environment so that I can start practicing security. One of these machines has a Pentium 4 processor and 512 MB RAM; ...
3
votes
2answers
1k views

SIEM and Windows Event Logs

When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...
12
votes
4answers
691 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
20
votes
3answers
2k views

Can Windows malware harm a Linux computer when it's executed with Wine?

I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables. I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
14
votes
4answers
4k views

Three-Factor Authentication for Windows

This HowToGeek article... http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/ ...got me thinking. Is there any software (or combination of software) that ...
14
votes
2answers
4k views

Hiding user account names from unauthenticated RDP sessions

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
13
votes
3answers
38k views

How do you discover what permissions an AD group has, if you have no documentation?

You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the ...
4
votes
1answer
4k views

Windows task manager can see all processes as non administrator without permission

On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
1
vote
1answer
545 views

Firefox Desktop Shortcut Being Renamed

On my Vista PC the Firefox shortcut icon is being randomly renamed. The name changes to some variation of a recently visited URL. This unwanted action has survived several version updates. Of course I ...
11
votes
3answers
1k views

Attacks against windows kiosk software

I am interested in potential/actual attacks against kiosk software. I am not talking about physical access, or specifically designed kiosk operating systems or shells, bur rather software that runs ...
0
votes
1answer
119 views

Windows network specific attacks

I have limited experience with Windows networks and certainly no experience with AD forests or anything related. I have experience and understanding how to secure and maintain a unix style network. ...
5
votes
1answer
284 views

Secure access to a Microsoft Access Database

I have a server set up with medical files in a Access database. I am taking over this job from an existing guy who has vanished, so I don't know all the details of the system. I can find out specific ...
5
votes
2answers
772 views

What are the risks associated with relying on IPSec IP Filtering?

When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox). Because IPSec Filtering is not stateful, ...
6
votes
3answers
4k views

What differences are there between built-in Administrator and other Administrators?

Are there any significant differences in the rights, privileges, permissions, or other powers held by the built-in Administrator account, and those held by non-built-in Administrator accounts?
4
votes
1answer
575 views

Does sandboxie “grab” all the system calls?

Sandboxie: http://www.sandboxie.com Does sandboxie "grab" all the system calls, e.g.: filesystem calls? Or it "grabs" all the low level calls from a process?
29
votes
3answers
22k views

How does the Windows “Secure Desktop” mode work?

Can anyone explain (or provide a link to a simple explanation) of what the Windows "Secure Desktop" mode is and how it works? I just heard about it in the KeePass documentation (KeePass - Enter ...
1
vote
1answer
2k views

RDP vs. VNC when looking them from security side

Regarding: http://unix.stackexchange.com/questions/12924/ssh-tunnel-with-vnc Which one would be better, if we look it @security side? I heard that RDP is very very poor when it comes to security.