A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

4
votes
4answers
3k views

How to make / dump contents of memory for forensics analysis?

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows ...
4
votes
2answers
450 views

Added value of Windows Server 2008 over 2003 in terms of security

What is the added value of a Windows 2008 Server over Windows 2003 in terms of security? Does Windows Server 2008 has enhanced/new security features compared to 2003?
4
votes
3answers
200 views

Can a web server be secured with just a firewall?

I'm about to go online with my first web site, it is a small project hosted on a regular home PC running Windows 7. I want to keep the software footprint at minimum, so it only contains the operating ...
4
votes
2answers
305 views

Windows Authentication and Session Ids

After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
4
votes
2answers
400 views

Are there any Windows permissions management applications?

I am currently dealing with permission issues with an IIS app pool. I am tired of clicking through window after window to set permissions on folders for domain and local users. Also, I would like ...
4
votes
1answer
370 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
4
votes
2answers
173 views

Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?

I currently work in a manufacturing company with round about 5000 computers and 6000 employees. We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
4
votes
3answers
296 views

Strategy against browser exploits on Windows?

On a friend's computer is some kind of spam bot installed. It sends messages like Hello: I received my apple iPad 32GB ordered on an online shop (www.elevalley.com ) today. So exciting ...
4
votes
2answers
1k views

How does syskey in Windows increase the security in a domain?

I use syskey in windows XP and Windows 7. I've read Microsoft's article but I have questions. How does this solution increase security? What are differences between using Syskey in a client that ...
4
votes
1answer
360 views

Is Window's system restoration useful for getting rid of malware?

If your computer has been infected with some kind of malware, could a restoration of the system, using the tool provided by windows, help you getting rid of that malware? We should suppose that it ...
4
votes
1answer
2k views

What are the security implications of enabling WINRM on all domain members?

As Powershell becomes more and more popular, it appears that using WINRM may end up being a better option than using PSEXEC from SysInternals for remote management. Given that WINRM is disabled by ...
4
votes
2answers
3k views

Utilman.exe command prompt hack prevention?

This trick to hack windows and reset passwords(or create new logins)has been around for ages and still works on windows 7 and windows 8. Is there any way to disable the key combination that brings up ...
4
votes
2answers
5k views

Windows groups and permissions: Authenticated Users group meaning

What is the purpose of the "Authenticated Users" group in Windows? Under Linux it doesn't exist and I'm starting to think this is another idiosyncrasy or over-engineering of the Windows operating ...
4
votes
3answers
2k views

Wine or sandboxie as sandboxes

I'm looking for a sandbox for Windows. I've looked at sandboxie but I don't know if it delivers what it promises. Is it actually safer to run programs inside sandboxie ? I know a full-blown VM could ...
4
votes
2answers
5k views

How do you properly setup Tor on Windows 7?

How do you properly setup Tor on a Windows 7 box to guarantee that ALL connections will run through Tor?
4
votes
1answer
1k views

Can a certificate have multiple chains and multiple self-signed roots?

The following MSFT document has this paragraph: All possible certificate chains are built using locally cached certificates. If none of the certificate chains ends in a self-signed ...
4
votes
2answers
2k views

Recover EFS encrypted folder after wiping system partition

We've recently ran into trouble while reinstalling one of client's desktop computer. Disk was split into two master partitions named C: and D:. We wiped out C: and reinstalled system (Win XP SP2 ...
4
votes
1answer
3k views

Windows task manager can see all processes as non administrator without permission

On Windows Server 2008 R2 operating as a standard user, when I open Task Manager I can see all the processes from different users on the system. I have the option to click "Show all processes" which ...
4
votes
1answer
434 views

Does sandboxie “grab” all the system calls?

Sandboxie: http://www.sandboxie.com Does sandboxie "grab" all the system calls, e.g.: filesystem calls? Or it "grabs" all the low level calls from a process?
4
votes
2answers
466 views

how unsafe is it for Windows webserver IIS to have domain privileges

Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. ...
4
votes
1answer
158 views

Remove a privilege from a Windows admin account : good or useless idea?

In order to protect a Windows administrator account from attacks such a Pass-the-Hash and other Token Passing tehcniques (e.g. via Incognito tool), can you tell me if it is a good idea to remove the ...
4
votes
1answer
99 views

Is access to the caller API in mobile phones a real security threat?

From time-to-time I receive "Unknown" caller on my mobile phone. I do not want to answer those calls as I do not trust the identity of a caller. I feel safer if I can see caller name or at least ...
4
votes
4answers
284 views

How to securely delete a table in MS-Access?

I have a Windows 7 computer which currently has a large working Microsoft Access 2007 database on it containing some tables with confidential data. I would like to securely delete/remove the tables ...
4
votes
2answers
179 views

With full access to the disk of an IIS web server, could you access the database server?

Here is a theoretical setup: You have a web server running Windows Server with IIS You have a website running here which connects to a database This website can start automatically when the server ...
4
votes
3answers
160 views

can I find on which machine was a zipped archive created?

I have the following security issue. A zipped archive of emails was found on a machine (A) by using an undelete program. The claim made by the subject of the investigation is that they made the ...
4
votes
1answer
2k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
4
votes
1answer
308 views

Need help on understanding obfuscated code in CVE-2012-4969 exploit

As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code. Is it necessary to use obfuscation ...
4
votes
2answers
343 views

When do Ps Tools send cleartext passwords, and how can I demonstrate this?

The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat. Note that the password is transmitted in clear text to the remote ...
4
votes
5answers
4k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives

In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work: Dim WshNetwork Set WshNetwork = ...
4
votes
1answer
430 views

CDNs used by Windows Update

My question is about CDNs (Content Delivery Networks) and their simultaneous use for legal and questionnable stuff. One specific example is the following. I'm noticing taffic from our network to the ...
4
votes
2answers
372 views

How to hack a Win95 machine?

While playing with old operating systems, I came across that there are no remote code execution exploits available for Win95 machines, running just file share (no IIS or anything else). Win95 neither ...
4
votes
1answer
143 views

Managing a large amount of MBSA Results?

I am responsible for scanning and fixing issues on ~50 servers with Microsoft Baseline Security Analyzer (MBSA) version 2.2. Unfortunately, there is no out of the box way to manage multiple MBSA ...
4
votes
2answers
4k views

Discover what workstations a user us connected to in a Windows AD Environment?

I currently have a naughty user in my environment. We don't want to set any alarms of (even from speaking to the AD admins), and wish to discover the workstation the user is connected to in our AD ...
4
votes
3answers
15k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
4
votes
1answer
179 views

Does DPAPI works if a user hasn't a login password?

I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...
4
votes
1answer
2k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
4
votes
2answers
1k views

Securing Windows 7 using Bluetooth

I'm thinking of using my iPhone as a device combined with a low power bluetooth usb key. So when the phone is gone the workstation locks. (I don't want it to unlock the workstation though, I'd prefer ...
4
votes
1answer
503 views

Security Risk of Disabling forceguest in non-AD Environment

Our application group is looking to deploy a product which requires that we disable forceguest in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. We are running on a Novell network (I know, I ...
3
votes
4answers
179 views

Shared hosting vs VPS

I have an Asp.net site. Which hosting system do I need to secure it adequately* against anyone reading private information that's on the server? This is assuming I'm not worried about the sysadmins ...
3
votes
4answers
474 views

Is it possible to catch a virus on my LAN without clicking on anything?

My unpatched PC running Windows is connected to a network which contains other "infected" computers, can I get infected by viruses without any interaction on my part?
3
votes
2answers
532 views

Encrypt web.config file using Data Protection API

I have encrypted part of my web.config file using the Data Protection API. Now, my question is, what does a hacker need in order to decrypt the web.config file? Does he require physical access to ...
3
votes
4answers
2k views

Reboot to clean state daily, on Windows

I already know that this can be done on Linux, One can boot to a flash drive that is write protected. Live modify folders can be symlinked to to a swap partition, and this prevents viruses from being ...
3
votes
2answers
1k views

Time server security error

Today at work, we brought out some PCs that were not used for a long time (were not in use when I joined this company so I have no idea about their history). After booting one of them (Windows XP ...
3
votes
4answers
1k views

Is Windows Firewall suitable for running in a production environment?

Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough? I'm running a VPS with Rackspace on their cloud ...
3
votes
1answer
5k views

Setting up Windows laptops to require a smartcard for unlocking

I am looking for details on how to secure a windows laptop using smart cards. The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
3
votes
3answers
10k views

Windows 7 Password Hash Security

I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes. I understand that these hashes are stored in the SAM ...
3
votes
3answers
1k views

what is the best keylogger for security uses?

Today we were robbed. A thief come to our home at night and stole some stuff including my brother's laptop. I think that the right thing to do is to download a keylogger on my PC, just in case... I ...
3
votes
3answers
1k views

Is there is a way to lock my USB port over the device physically?

Is there is a way to lock my USB port over the device physically ? For example I am connecting the USB mouse and keyboard on an public computer but I do not want anyone to remove them physically. I ...
3
votes
2answers
679 views

Difference between vulnerabilities on windows/linux/mac for same program

If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
3
votes
2answers
167 views

Potentially unsafe files on second hard drive, how to get my files back?

I have my files on a second hard drive (disconnected for now). This drive was connected to a system infected with Virus:W32/Virut. I have formatted my main hard drive and reinstalled Windows XP. Now I ...