MarkMlnasi Byron Hynes

Transcription

1 A ul ^HP &1 ^n* JÜ& MarkMlnasi Byron Hynes i 1 8 O 7,^ j Wiley Publishing, Inc. Mark Minasi U Windows Administrator X. Library

2 Table of Contents Introduction Chapter 1 Administering Vista Security: The Little Surprises 1 Restoring the Administrator 1 Making Your Own Administrator 2 Activating the Administrator Account 2 Power Users Are Essentially Gone 4 "Run..." Is Off the Start Menü 7 BOOT.INI Is Gone, BCD Is Here 8 boot.ini Review 8 BCD Terminology 10 Creating a Second OS Entry 12 Understanding Vista Boot Manager Identifiers 12 Choosing Timeout and Default OS with bcdedit 13 Changing an Entry Option 14 Cleaning Up: Deleting OS Entries 16 "Documents and Settings" Is Gone, Kind Of 16 IPv6 and Network Properties 17 Remote Desktop Gets a Bit More Secure 21 NTFS and the Registry Are Transaction Based 23 Undelete Comes to Windows for Real! 24 Changes in Security Options 25 Changes to Named Pipe Access 26 Changes to Share and Registry Access 27 LM Deemphasized, NTLMv2 Emphasized 28 No More Unsigned Driver Warnings 30 Encryption News 31 Vista Includes New Cryptographic Services 31 You Can Encrypt Your Pagefile 32 Offline Files Folders Are Encrypted per User 32 New Event Viewer 32 XML Format Comes to Event Viewer 33 Custom Queries Lets You Customize Event Viewer 35 Generating Actions from Events 38 Telling the Event Log Service to Display Messages 41 Forwarding Events from One Computer to Another 43 Subscription Overview 43 Creating an Example Subscription 44 Troubleshooting Subscription Delays 50 Event Forwarding in Workgroups 52

3 x Table of Contents Chapter 2 Understanding User Account Control (UAC): "Are You Sure, Mr. Administrator?" 59 Introducing UAC 59 Why UAC Is Good, after All 61 UAC Benefits for Users 61 UAC Benefits for Admins 62 UAC as a Transition Tool 62 An Overview of UAC 63 Digging Deeper into UAC 66 How Windows Creates the Standard User Token 66 How to Teil UAC to Use the Administrator Token 74 What Teils Windows to Use the Administrator Token 81 Reconfiguring User Account Control 101 Turning UAC On, Off, or in Overdrive 102 Configuring UAC Junior: UAC for the User 103 Side Point: How "Administrator-ish" Must You Be to Get UACed? 104 Excluding the Built-in Administrator 105 Telling UAC to Skip the Heuristics 106 Controlling Secure Desktop 106 Sign or Go Home: Requiring Signed Applications 109 Working around Apps That Store Data in the Wrong Places 111 The Big Switch: Turning Off UAC Altogether 111 Will UAC Succeed? 112 Summary 113 Chapter 3 Help for Those Lame Apps: File and Registry Virtualization 115 File and Registry Virtualization Basics 115 Seeing File Virtualization in Action 116 File and Registry Virtualization Considerations 118 Which Areas Are Protected and Where They Are Virtualized 118 How Virtualization Handies Files 119 How Virtualization Handies the Registry 120 What Does "Legacy" Mean, Exactly? 122 Seeing Virtualization in Standard Versus Administrative Users 123 Tracking Virtualization 125 A Possible Virtualization Problem 127 Controlling Virtualization 127 The Future of Virtualization 128 Summary 129

4 Table of Contents xi Chapter 4 Understanding Windows Integrity Control Windows Integrity Control Overview Mandatory Controls Versus Discretionary Controls The Orange Book C2 Certification and NT C and B: Discretionary Versus Mandatory WIC Components WIC's Six Integrity Levels How Objects Get and Store Integrity Levels: Mandatory Labels Process Integrity Levels Seeing Processes in Action Setting Up Example: Starting a Low Integrity Application Internet Explorer Protected Mode and WIC A Prime Directive Puzzle: WIC and Deletes Using WIC ACEs to Restrict Access Things WIC ACEs Can't Do You Cannot Apply Mandatory Labels with Group Policy You Cannot Create Standard Permissions That Name Mandatory Labels A Note on Modifying System Files Dialing Up Custom Labels Meet SDDL Strings Understanding the Secret Language of Bs: SDDL Label Syntax Using SDDL Strings to Set Integrity Levels Summary Chapter BitLocker: Solving the Laptop Security Problem 183 The Laptop Security Problem Today 184 BitLocker Drive Encryption The Overview 185 BitLocker Components 186 WhatlsaTPM? 187 Füll Disk Encryption 188 Encryption Algorithm 191 Key Storage 193 Authentication or Access Control 196 Increasing Security with Additional Key Protectors 196 Boot Process Validation (Integrity Check) 199 Enabling BitLocker for the First Time 201 Using BitLocker without a TPM 204 Summary of Key Protectors 205

5 xii Table of Contents Recovery Recovery Example 1: Desktop Hardware Failure (Stand-alone System without a TPM) Recovery Example 2: Laptop Hardware Failure (TPM-based) Recovery Example 3: Lost USB Key (Computer with a TPM) Recovery Example 4: "Found" Laptop Recovery Summary BitLocker and Active Directory Group Policy Options Managing the TPM and BitLocker in the Enterprise Servicing a BitLocker-Protected Computer Secure Decommissioning Planning for BitLocker Deployment Summary Chapter 6 Post-Boot Protection: Code Integrity, New Code Signing Rules, and PatchGuard Address Space Layout Randomization Giving 64-bit More Armor PatchGuard Code Integrity What Can Go Wrong? New Code Signing Rules What Is Code Signing and Why Does It Matter? ActiveX Controls Protected Media Path Requirements x64 Requirements Getting Down to Business: Code Signing an Application or Driver Getting Down to Business: Deploying an Application or Driver Signed by a Publisher Summary Chapter 7 How Vista Secures Services Services in Brief Service Control Manager How Vista Toughens Services: Overview Session Separation Reducing Service Privileges Developers Can Reduce Service Privileges Admins Can Also Reduce Service Privileges

6 Table of Contents xiii Special Case: Multiple Services Needing Different Privileges 249 Reduced Privilege Summary 250 Service Isolation 251 How Service Isolation Works 251 Restricting a Service's SID 252 Granting Write Permissions to a Service SID 252 Understanding the sc.exe Restricted SID Commands 254 Restricting a Service's Network Ports 255 Summary 255 Index 257