1. Total Workstation Lockdown: Your Action Plan Jeremy Moskowitz, Group Policy MVP Chief Propeller-Head: GPanswers.com Founder: PolicyPak Software (policypak.com) Twitter: @jeremymoskowitz

2. “What I learned in Belgium” – by Jeremy Moskowitz

9. Disclaimer: Don’t go bananas (and don’t expect a ‘Magic Silver Bullet’) Tendency to go “overboard” No “one way” to skin the cat Not going to go over all possible solutions No “Silver Bullet.” It’s incremental, iterative, and ongoing. This talk (mostly) Group Policy-based solutions

10. Item 1: Hardware Lockout Scenario Need to restrict USB / other devices on network Perfect for… Computers Specific users Utilize: Group Policy (Windows Vista and later) Group Policy Preferences (Windows XP and later)

11. Hardware Lockout Demo

12. Item 2: Understanding Loopback Scenario Need to implement USER side settings to COLLECTION of computers Perfect for… Call Centers Classrooms Terminal Services

13. Loopback Demo

14. Item 3: Security Compliance Manager Big (free) tool with lots of functions.. Contains pre-configured GPO baselines from the Windows Security Guides Lets you create baselines (and manage them) Output as: GPO, XLS, Desired Configuration Management (DCM) packs, or Security Content Automation Protocol (SCAP) http://technet.microsoft.com/en-us/library/cc677002.aspx

15. Item 4: Security Compliance Manager

17. Item 3: Security Compliance Manager

18. Security Compliance Manager Demo

19. Item 4: "Workstation Revert" Scenario: Ensures machines won’t be modified in “hostile” environment Perfect for: Schools Internet Café Walk-up machines Shop Floor / Kiosk / Library Home use (possibly)

20. Microsoft’s Solutions Windows SteadyState 2.5 Windows XP and Windows Vista only http://tinyurl.com/steadystate25 Warning: Being retired as follows: No more downloads after 2010 No more support after 2011 Free Downloadable PDF chapter about SteadyState at www.GPanswers.com/book www.GPanswers.com/book “Going forward” documentation Creating a Steady State by Using Microsoft Technologies Group Policy Settings for Creating a Steady State The Steady State Reference Spreadsheet

21. SteadyState-Like Items For Windows 7 Free Wioski Win7 + VHD + WIM “wrapper” / trickery www.wioski.com Commercial DeepFreeze from Faronics Win7 Compatible http://tinyurl.com/DeepFreeze-TechEd2010

22. Item 5: AppLocker / Software Restriction Policies Notes: AppLocker not available for all editions of Windows 7 Software Restriction Policies IS available for all editions of Windows 7 Software Restriction Policies: Good for Blacklisting AppLocker: Better for Whitelisting

23. Item 6: Application Settings Lockout ADM/ADMX files for supported applications Office 2010 ADMX files http://tinyurl.com/Office2010ADMX All other applications… PolicyPak Community Edition (Free) PolicyPak Professional Edition

24. Stay up to date with TechNet Belux Register for our newsletters and stay up to date: http://www.technet-newsletters.be Technical updates Event announcements and registration Top downloads Join us on Facebook http://www.facebook.com/technetbe http://www.facebook.com/technetbelux LinkedIn: http://linkd.in/technetbelux/ Twitter: @technetbelux Download MSDN/TechNet Desktop Gadget http://bit.ly/msdntngadget

25. TechDays 2011 On-Demand Watch this session on-demand via TechNet Edge http://technet.microsoft.com/fr-be/edge/ http://technet.microsoft.com/nl-be/edge/ Download to your favorite MP3 or video player Get access to slides and recommended resources by the speakers

26. Do MORE with Group Policy

27. THANK YOU