WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Security Considerations for Portable Computers

Because portable computers are vulnerable to theft, it is important that you secure a portable computer and the data on it with as many Windows 2000 security features as possible. In general, hard drives format to use NTFS so that permissions can be set and encryption (EFS) enabled on files and folders. Add the users of portable computers to the Power Users group so that they have maximum control of the computer without having full control of the system. Users should use strong passwords for logging on to their network and administrators should use strong passwords for the local administrator account. Use Group Policy settings as much as possible to restrict access to the computer and any data on it. For more information about these security features, see "Security," "Managing Files, Folders, and Search Methods," and "File Systems" in this book. In this section, the discussion focuses on security considerations that are relevant to portable computers, including undocking privileges, BIOS security, and security for offline files.

Undocking Portable Computers

Portable computers can be undocked in any one of the following ways depending on the type of docking station, the type of portable computer, and the permissions and Group Policy settings that have been implemented on the computer.

While the portable computer is shut down and the power is off, someone physically ejects it or removes it from the docking station (a cold undock).

While the portable computer is running, someone physically ejects it or removes it from the docking station (a surprise removal).

While the portable computer is running, someone uses the Eject PC command in Windows 2000 Professional to eject the computer from the docking station (a hot undock).

Each of these undocking methods relies on a different security mechanism to restrict undocking. Some of these security mechanisms are configurable, and some are not.

Undock Notifications

Depending on how a portable computer is undocked, Windows 2000 might or might not receive notification. Depending on how the notification is reported, Windows 2000 might or might not be able to authorize the undock event.

When someone shuts down a portable computer and physically ejects or removes it from its docking station, Windows 2000 is not notified that the computer is being undocked (that is, turned off). In this case, the only security that restricts undocking is physical security (for example, a keyed lock on the docking station or a cable connected between the docking station and the portable computer).

When someone physically ejects or removes a portable computer from its docking station without first shutting down Windows 2000 or turning off the portable computer, the BIOS notifies Windows 2000 that the portable computer has been undocked. This notification is initiated in kernel mode. When an undock notification is initiated in kernel mode, Windows 2000 does not perform a security check to determine whether there are any restrictions (for example, Group Policy settings) that affect the removal of the computer. In other words, Windows 2000 performs no security check. In this case, the only security mechanism that restricts undocking is physical security.

When someone uses Eject PC in Windows 2000 Professional to eject or remove a portable computer from a docking station, Windows 2000 is notified that the computer is being undocked. This notification is initiated in user mode. When an undock notification is initiated in user mode, Windows 2000 performs a security check to determine whether there are any undocking restrictions.

Setting Undock Permissions

You can choose a local Group Policy setting that controls who has docking privileges on a portable computer. If a user has the undocking privilege, he or she is able to use the Eject PC command. If the user does not have the undocking privilege, the Eject PC command is not available. However, any program can call the application programming interface (API) that controls the Eject PC command, which means that any program can have its own button or menu item that tries to eject a portable computer. If a user tries to use such a button or menu item and doesn't have the undocking privilege, the command fails, but the user is not notified about why it failed.

To set undocking privileges by using group policy

From the Start menu, click Run, and then type::

gpedit.msc

Press ENTER.

In the view pane of Group Policy, under Computer Configuration, open the Windows Settings folder, Security Settings, and the Local Policies folder.

Click the User Rights Assignment folder.

In the details pane, double-click Remove computer from docking station.

In the Local Security Policy Setting dialog box, under Local Policy Setting, clear the check box next to any user or group that you do not want to have the undocking privilege. If you want to add users and groups to the list, click Add.

NOTE

---

This procedure restricts undocking only when a user attempts to undock a portable computer by using the Eject PC command.

By default, undocking privileges are granted to everyone during clean installs of Windows 2000 and during upgrades from Windows 95, Windows 98, and Windows NT 4.0. In these cases, you must use the preceding procedure if you want to prevent users from undocking.

BIOS Security

Some computers allow you to implement system security or device security at the BIOS level. Equipment manufacturers usually implement this type of security by requiring a password at startup while the BIOS is loading. If the user enters an incorrect password, the BIOS does not finish loading and the computer does not start; or the BIOS might finish loading, but it does not transfer control of the computer to Windows 2000. Although this type of security is designed to control access to the computer at startup, it might also control access when the computer resumes from a low power state such as standby mode or hibernate mode. In these cases, users might have to enter the BIOS password when the system resumes from either standby or hibernate mode.

If you want to implement BIOS security on a portable computer, contact the portable computer manufacturer to verify that it operates properly with the standby and hibernate features of Windows 2000. Also be aware that BIOS security can supercede Windows 2000 security insofar as it prevents Windows 2000 from taking control of the computer or various other devices.

Offline Files

Offline files use two types of security to ensure that offline files are secure. The first type of security protects the Offline Files folder, including the Offline Files database and the stored offline files, from unauthorized access. The second type of security ensures that offline files and folders behave like their network counterparts with regard to user rights.

Protecting the Offline Files Folder

Offline files are stored (cached) in the Offline Files folder. This folder is machine-centric not user-centric, which means that there is only one Offline Files folder for each computer and all offline files are stored in this folder. By default, this folder is protected by administrator-level permissions so that unauthorized users cannot view the contents. However, these permissions are only applied to the folder if the folder is located on a drive that is formatted to use NTFS. (A warning notifies you of this when you first cache an offline file on a FAT or FAT32 drive.)

Maintaining File and Folder Permissions

In addition to the protection afforded by the permissions on the actual Offline Files folder, offline files and folders retain the permissions set specifically on them when they were on the network share. This type of security is important if multiple users use a single computer. For example, if John creates a file on a network share, changes its permissions so that only he has access to the file, and then makes the file available offline, another user who tries to open the offline version of the file on John's computer is denied access just as if he or she tried to open the file directly on the network share.

This type of security is applied to offline files independent of the formatting of the user's hard disk. In other words, if you set permissions on a file on a network share that is formatted to use NTFS and you make that file available offline on a computer that has a FAT or FAT32 drive, the permissions carry over to the offline version of the file, even though the drive is formatted to use FAT or FAT32.

NOTE

---

Offline files and folders do not retain encryption. If a user encrypts a file or folder on a network share using EFS and then makes the file or folder available offline, the offline version of the file or folder is not encrypted with EFS.

Also, you cannot encrypt the Offline Files folder by using EFS. It is a system folder, and system folders cannot be encrypted.