Slashdot Mirror

Well - only if one is foolish enough to surf the web and check email and do your other daily computer chores, while being logged in as root/administrator to your computer ...

rootkits, malware, trojan, etc. still require root/administrator rights to install themselves.

http://kareldjag.over-blog.com/article-1232530.html
http://technet.microsoft.com/en-us/library/bb456992(loband).aspx
http://technet.microsoft.com/en-us/library/cc700846(loband).aspx

The above is old school on Unix (and applies to any OS) - only login as root/administrator if you need to do system maintenance.

For everything else use a Least Privilege User Account.

And - first install and run software in an isolated virtual machine with InstallWatch running and see what is being installed/executed. If the installer/software is doing anything suspicious, simply do not install it on your real machine. As simple as that ...

I have used the freeware installwatch pro software for similar purposes. It is not perfect, but allows you to take a snapshot of all files and reg keys prior to performing 'some' action (browser option change, software install, etc.). After you finish the action, you perform another snapshot and it traps the deltas across filesystem - file add, delete, modify - including .ini changes and also reg key add/del/change activities.... It also stores the deltas by whatever you wish to name the change, for future reference.. Installwatch Pro - http://epsilonsquared.com/ They have another tool, install rite, which I am unfamiliar with...

Appget and Installrite are the two freeware Windows programs I simply can't live without. Appget allows me to quickly find the updates the pc needs, while installrite allows me to make easy to deploy automated install .exe files for the freeware I give to any customer whose pc I work on. If they don't have MS Office installed I give them Openoffice, if they desire multimedia playback I give them klite codec pack, and for pictures I give them Paint.net and the Gimp. And with installrite the installation is simply two clicks and I'm done.

Give either or both a try and you won't be disappointed. And if anyone needs to know the steps to make an automated installkit with installrite feel free to email me, and if enough folks require the steps I'll post them here in my journal.

Actually, I was able to get every application you listed to run as a normal "user" account. I have repacked and given special permissions for hundreds of third party apps to get them to run non-admin.

The last co. I worked for decided to do this, boy you should have seen the backlash and uproar from users. Everyone from other IT depts, engineers, heck even secretaries were mad. However, once we successfully implemented a locked down environment help desk calls were dramatically reduced.

It's actually not as hard as you think to get "legacy" apps to run correctly as a non-admin. The best tools for this can be found at Sysinternals http://www.sysinternals.com/, regmon and filemon. Just install the app as an admin, then try to run it as a user. Regmon and Filemon will tell you where you get an "access denied" error. When repacking the app, just make sure to give the appropriate permissions to keys/files that the app writes to. InstallRite from epsilon is also pretty handy http://www.epsilonsquared.com/ , its basically a nice front end to sysdiff.

Don't get me wrong, it isn't always easy. Some apps need to run exe's on the first reboot, some dynamically create files at winnt, but with a little programming know how you can create some tools to get around this.

... and the workstations are uniform, may InstallWatch and InstallRite, together with an scheduled Task or logon-script would do the trick? http://www.epsilonsquared.com/

Free sotftware, and does a nice job.

installwatch pro

It will even make an install program for you with the changes!

Being the M$ lowlife that I am, I can only recommend something for your rollout on Windows-based clients.

I recommend using InstallRite by Epsilon Squared Inc. to automate installation of any application on multiple PCs with different hardware and software configurations.

It's easy to use and the documentation is good, IMHO. A big plus is that it is Freeware. Checking it out might be beneficial to you.

Being the M$ lowlife that I am, I can only recommend something for your rollout on Windows-based clients.

I recommend using InstallRite by Epsilon Squared Inc. to automate installation of any application on multiple PCs with different hardware and software configurations.

It's easy to use and the documentation is good, IMHO. A big plus is that it is Freeware. Checking it out might be beneficial to you.

In real-time: FileMon installs a driver that transparently tracks filesystem accesses. If you want to see what accesses the drive every five seconds, this is a good tool for it.

If you want to see what files were modified, use programs like AIDE (on Unix) or Tripwire (on Unix or Windows 2k/NT, apparently), or InstallWatch (Windows). If you just want to see where an install program left its files, this is good. If a given program is just reading (not writing) files, or leaving temp files in ignored directories, then this is not effective.

You can examine the source for AIDE & Tripwire, so this isn't a chicken-and-egg problem.