Lubbock Community.
TTU Home Safe Computing Practices Lubbock Community Recommended Computing Practices

Best Practices for Setting up Your Computer

When installing a new Operating System, most installation CDs do not contain any security patches. These patches are what protect a computer from the dangers found on today's networks such as the on campus network. The vulnerabilities that these patches address include methods used by many viruses that automatically infect an un-patched machine within seconds after it has been connected to a network.

This poses a major problem due to the fact that when a new, fresh copy of an operating system such as Windows XP has been installed, the Operating System is immediately infected by any number of viruses, well before any patches or antivirus software can be installed.

Installing a patched version of Windows XP in a Hostile Network Environment:

  1. Obtain a Windows XP installation disk.
  2. Create a DOS boot disk containing the FDISK.COM executable.
  3. Disconnect the compromised system from the network until all critical security patches are applied.
  4. Boot the computer from the DOS boot disk prepared earlier and type FDISK /MBR at the command prompt. This will erase the master boot record so that any viruses that have infected the master boot record are destroyed.
  5. Insert the Windows XP installation CD into the CD-ROM. All drives should be formatted using the NTFS file system instead of FAT32.
  6. If a drive in current use is not setup with the NTFS File system there is a command that can be used to convert the drive. At the windows Command Prompt the following string will start the conversion process "Convert C: /FS:NTFS". This will not run in regular Windows but will run on the next reboot, typically 20 - 30 minutes depending on the system.
  7. Allow the machine to boot to the CD and begin the XP installation.
  8. During installation, disable or remove all unneeded Local User Accounts. This includes accounts setup by Microsoft Services, such as ASP. Net. All Local User and Administrative Accounts need strong password protection.
  9. ALL File Shares that are set up should have permissions set for specific users or user groups. By default, the "Everyone" group is given rights to a new file share. This group, along with any other generic groups, should be removed.

In addition to the required "baremetal" installation as described above, the following is recommended:

  1. Run Windows Update and install any new critical security updates and service packs. Microsoft Critical Updates are available at http://windowsupdate.microsoft.com.
  2. Configure Windows to automatically download and install Critical Windows Updates when they are released. View instructions.
  3. Install the latest version of free business applications with each new installation.
  4. Have your antivirus program installed and configured to update on a daily basis and to run a full system scan once a week.
  5. Lab systems should be re-imaged regularly from an updated reference system.
  6. Enable the Microsoft Internet Firewall.
  7. Disable unnecessary OS service processes, such as, Windows Messaging, Telnet, SMTP, etc.
  8. Ensure that all of the application software is properly patched.