A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.
5
votes
2answers
665 views
Wine or sandboxie as sandboxes
I'm looking for a sandbox for Windows. I've looked at sandboxie but I don't know if it delivers what it promises. Is it actually safer to run programs inside sandboxie ?
I know a full-blown VM could ...
5
votes
5answers
280 views
Introduction/refresher course on Windows security
Can someone point me to a blog or recommend a book with an introduction (or refresher course) to Windows security.
I am not a newbie programmer, actually have more than 10 years of experience, with a ...
5
votes
1answer
2k views
Windows task manager can see all processes as non administrator without permission
On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
5
votes
1answer
362 views
Does sandboxie “grab” all the system calls?
Sandboxie: http://www.sandboxie.com
Does sandboxie "grab" all the system calls, e.g.: filesystem calls? Or it "grabs" all the low level calls from a process?
5
votes
2answers
636 views
Password History/Password policy
I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008).
Where is password ...
5
votes
2answers
251 views
How can I detect users that have requested AD Administrators to reuse an expired password?
There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it.
...
5
votes
2answers
200 views
Need a software that can monitor and log network traffic of installed applications
I need to monitor and log network activities of a specific software installed on my system.
I know there are lots of network monitoring software out there, even system explorer has one built in.
I ...
5
votes
1answer
383 views
IPSec Domain Isolation with Windows Server
I'm looking for a good way to secure my servers, I have a set of dedicated servers that are not in my office but hosted by an external provider. ALL the servers have only one public (WAN) IP.
I don't ...
5
votes
2answers
234 views
Advice for writing my first application security review
I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
5
votes
2answers
385 views
What are the risks associated with relying on IPSec IP Filtering?
When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox).
Because IPSec Filtering is not stateful, ...
5
votes
1answer
1k views
How do I apply a security baseline to Windows 2008 R2?
I've setup a Windows 2008 R2 server with an Active Directory Domain Services role. I would like to apply the Specialized Security – Limited Functionality (SSLF) security baseline to it, but am unsure ...
5
votes
1answer
638 views
Windows mandatory access control: How to remove “mandatory level” label from the file?
1) How to remove "mandatory level" label from the file?
I have two files, for first icalcs return
Mandatory Label\Medium Mandatory Level:(NW)
for second icalcs doesn't return anything (that means ...
5
votes
2answers
818 views
Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?
I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
5
votes
1answer
481 views
How to know the windows security dialog asking for username password is genuine?
I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this
I noticed the "->" character in the domain name which usually it auto fills. Also ...
5
votes
1answer
112 views
How do I make or get computer certificates to use with IPSEC user authentication on Windows?
I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
5
votes
2answers
347 views
How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?
From NIST SP 800-53, Rev. 3:
SC-10 NETWORK DISCONNECT
Control: The information system terminates the network connection associated with a
communications session at the end of the session or ...
4
votes
4answers
2k views
How secure is Windows Auto-Logon?
Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question.
The question is, when I enable auto-logon for my Windows 7 box, will there ...
4
votes
3answers
92 views
Application to monitor software activities
I am doing black box testing on a software which is installed in my local machine. I want to analyze and see the list of files and registry entries that software create/modify/delete. Basically ...
4
votes
3answers
281 views
Security of login-data saved in browsers
Most browsers provide an option to save login-data for later use.
Suppose a Windows workstation is located in a well-protected corporate LAN and only a well-defined set of application can be launched ...
4
votes
3answers
175 views
Virus with PGP Encryption Preventing Virus Scan
A user reported having a virus that was causing pop up windows asking for money. When he turned on his laptop and logged into PGP encryption (whole disk) the desktop quickly showed but then a white ...
4
votes
3answers
414 views
Further potential problems with Windows 8 SmartScreen
Some research was recently published that showed that Windows 8's SmartScreen feature sends certain details about every single application that you install to Microsoft.
Ignoring the obvious privacy ...
4
votes
3answers
633 views
Windows Honeypot user account for tracking laptop
I've been wanting to create a dummy "Honeypot" user account on my Windows 7 laptop in case of theft.
My question is: Has anyone come across useful resources and tips for doing this? Is there a way ...
4
votes
1answer
262 views
Setting up Windows laptops to require a smartcard for unlocking
I am looking for details on how to secure a windows laptop using smart cards.
The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
4
votes
2answers
487 views
Difference between vulnerabilities on windows/linux/mac for same program
If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
4
votes
2answers
448 views
How would I go about rebuilding the IAT of a packed executable?
When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
4
votes
1answer
298 views
Server monitoring for security
We do a lot of web hosting management and have started to get into selling server management packages. However, we want to start monitoring servers for security related threats.
Our clients may use ...
4
votes
2answers
330 views
Added value of Windows Server 2008 over 2003 in terms of security
What is the added value of a Windows 2008 Server over Windows 2003 in terms of security?
Does Windows Server 2008 has enhanced/new security features compared to 2003?
4
votes
1answer
511 views
Why does Windows 7 require a password hint during setup?
Correct me if I am wrong, but I think Windows 7 is the only operating system out there that requires a hint for the first user created on the system (have not had a chance to check out Windows 8 ...
4
votes
2answers
111 views
Are there any Windows permissions management applications?
I am currently dealing with permission issues with an IIS app pool. I am tired of clicking through window after window to set permissions on folders for domain and local users.
Also, I would like ...
4
votes
1answer
233 views
How did my homepage get changed in IE?
I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
4
votes
2answers
501 views
Using Window Servers 2003 after security updates are discontinued
Let's say that Microsoft has stopped supporting Windows Server 2003 now so there is no any security updates and I use that system for Domain Controller (Windows XP/7 Professional Clients) and File ...
4
votes
3answers
1k views
How to make / dump contents of memory for forensics analysis?
I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
4
votes
2answers
144 views
Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?
I currently work in a manufacturing company with round about 5000 computers and 6000 employees.
We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
4
votes
3answers
387 views
What are the most common files to check with File integrity monitoring software?
I have a file integrity monitoring suite and in it I have to select specific files and folders for it to monitor. There are some obvious services that I want monitored like our web-server.
Is there a ...
4
votes
2answers
314 views
How can I assess the strength of user passwords in my office environment?
I want to assure the compliance of password policy in my office.
Environment Intro
My environment is all windows based (server 2003/2008) user base is not more than 400 employees. Nearly 90% of all ...
4
votes
3answers
284 views
Strategy against browser exploits on Windows?
On a friend's computer is some kind of spam bot installed. It sends messages like
Hello:
I received my apple iPad 32GB ordered on an online shop
(www.elevalley.com ) today. So
exciting ...
4
votes
2answers
582 views
How does syskey in Windows increase the security in a domain?
I use syskey in windows XP and Windows 7. I've read Microsoft's article but I have questions.
How does this solution increase security?
What are differences between using Syskey in a client that ...
4
votes
1answer
194 views
Is Window's system restoration useful for getting rid of malware?
If your computer has been infected with some kind of malware, could a restoration of the system, using the tool provided by windows, help you getting rid of that malware?
We should suppose that it ...
4
votes
2answers
155 views
What is multi-path malware?
I would like to know, in malware analysis, what is meant by "multi-path execution". I read this when I encounter the words in malware detection literature related to Control Flow Graph (CFG).
4
votes
1answer
1k views
What are the security implications of enabling WINRM on all domain members?
As Powershell becomes more and more popular, it appears that using WINRM may end up being a better option than using PSEXEC from SysInternals for remote management. Given that WINRM is disabled by ...
4
votes
2answers
3k views
How do you properly setup Tor on Windows 7?
How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
4
votes
1answer
444 views
Can a certificate have multiple chains and multiple self-signed roots?
The following MSFT document has this paragraph:
All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed
...
4
votes
2answers
1k views
Recover EFS encrypted folder after wiping system partition
We've recently ran into trouble while reinstalling one of client's desktop computer.
Disk was split into two master partitions named C: and D:. We wiped out C: and reinstalled system (Win XP SP2 ...
4
votes
2answers
277 views
how unsafe is it for Windows webserver IIS to have domain privileges
Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. ...
4
votes
2answers
138 views
Windows Vista user logon integrity
Is it possible to delete some or all user session logon datetime records from Windows Vista? Is there any mechanism to give me confidence that individual records aren't deleted even if there isn't a ...
4
votes
5answers
2k views
Preferred UAC configuration in Enterprises that use Login scripts to map drives
In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work:
Dim WshNetwork
Set WshNetwork = ...
4
votes
4answers
202 views
How to securely delete a table in MS-Access?
I have a Windows 7 computer which currently has a large working Microsoft Access 2007 database on it containing some tables with confidential data. I would like to securely delete/remove the tables ...
4
votes
2answers
88 views
With full access to the disk of an IIS web server, could you access the database server?
Here is a theoretical setup:
You have a web server running Windows Server with IIS
You have a website running here which connects to a database
This website can start automatically when the server ...
4
votes
4answers
121 views
can I find on which machine was a zipped archive created?
I have the following security issue. A zipped archive of emails was found on a machine (A) by using an undelete program. The claim made by the subject of the investigation is that they made the ...
4
votes
1answer
543 views
AIA/CRL locations for Offline Root
I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an ...
