Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it feasible to lock down a user account on a Windows 7 or Windows Vista laptop so that it's not possible to copy files off of it? (e.g. disable all internet access, disable USB ports or at least ensure drives can't be mounted to them, etc).

Is there a published procedure to do that?

Also, if the files are encrypted on disk using Windows encryption, is knowledge of the guest user password on the laptop enough to access those files if the hard drive is plugged into another computer?

I do realize that a sophisticated hacker can probably counter pretty much any security measure. The intent is to prevent copying files off of the laptop by power users, not by hackers.

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

In a word, no.

If you're okay with locking down the entire drive, you can get very close with whole-drive encryption. Without this, someone will always be able to pull the drive out of the machine and connect to another one running off-the-shelf data recovery tools. Even with whole-drive encryption, it's just a matter of time with the right tools.

share|improve this answer
    
If I may add, there are also several Device Control solutions that would aid in securing the laptop. I'm particularly fond of Sophos, but have also used Guardian Edge and others. These allow you to specify by policy what devices can connect to the laptop. This is excellent for helping lock down USB ports. –  Jes Sep 15 '10 at 20:29
    
On Win7 GPO can lock out all external drives. AppLocker can lock out all unapproved programs (Just don't approve ones that can connect to the Internet, or anything extra for that matter). BitLocker drive encryption can be set to 256 Bit AES; while it's technically possible to break, nobody in their right mind would try. While it's impossible to get it 100% secure, you can make it really close with the aforementioned. –  Chris S Dec 9 '10 at 2:03
add comment

An encrypted drive is as close as you can come. All other measures are circumvented by simply removing the drive and installing it into another machine and are therefore simply "feel good" measures and nothing more than a minor annoyance, even for a "power user". With the drive plugged into another machine it makes no real difference whether or not the user account passwords on the original machine are known to the person who wants to read the data.

If you are concerned about a legitimate user of the laptop copying data from it I would suggest a tech approach is the wrong way to go, because your real problem is human in nature and should be dealt with appropriately.

share|improve this answer
add comment

In addition to whole disk encryption, and USB lockdown, you will also have to remove your firewire ports (physically - you can't disable them sufficiently - so remove them or fill them in with epoxy or similar) and disallow CD/DVD writing.

And have you thought about what a user can do via email, file transfer...etc?

share|improve this answer
1  
The Firewire thing was fixed in XP SP3, and definitely doesn't apply to Vista or Win7. I know Win7 GPO can disable writing to all external drives as well. –  Chris S Dec 9 '10 at 1:59
    
Yeah - Win7 is pretty good on that front. Good call. –  Rory Alsop Dec 9 '10 at 9:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.