the shallow thoughts of a simple mind

In my quest to protect the work PC’s… running IE and NOT getting spyware…

Is is possible to make a Windows machine immune to most common spyware, viruses, and stupid people? The first and last options are suprisingly easy, just bolt down the C drive. Why it took so long to get this I will never know, but the single, most effective way of “immunizing” a computer from spyware and idiots is to simply disallow all users (with the exception of Domain Admins) rights to modify the C drive. Period.

If you first revoke a user’s write access to the C drive completely, with the exception of their home folder in Documents and Settings you pretty much immunize your computer from spyware and crapware which the user can install (can anyone say Yahoo toolbar?). The next step is to make sure your user’s aren’t administrators at the local level. That means you do not make the Domain Users group a member of the local administrators group. I know this sounds absurd but I have seen net-admins do this. Setting up your permissions in a restrictive way will allow your network admins to login and install software/modify the C drive while you bar your users from writing any kind of files to the C drive. You can’t stop a user from installing crap into his home directory or profile but if you have intelligent virus scanning at the network level you effectively prevent the spread of infections to your other computers. It’s also worth noting that the crap installed in a user directory does not affect other users, only the user who installed the crap. If you keep crap out of the Windows (Winnt on older boxen) and the Program Files folders your users won’t be able to infect the rest of the machine.

I doubt that this approach will be very effective against viruses as those usually exploit specific holes in the operating system but it may help to combat worms. In any case I have Panda Antivirus to handle that.

Note: This trick doesn’t work on any home edition of any MS product. These are crippled. Do yourself a favor and get the pro edition if you must have any edition at all.