Notice: This information is provided free of charge. The idea behind this is for this site to be my private personal technical resource when I am teaching on the road. Some site may link you to immoral, pornographic or objectionable web pages or images. I do not support or endorse these sites in any way. Visit these sites at your own risk. Dan Shea, or agents and associate companies or organizations will not be responsible in any way for incidents that may occur because of you visiting these site. These web site links presented here are for information use only. In order for you to educate your self on how the computers, networks, and security work. I am not here to teach you how to hack. My purpose is to help you as administer of your network to the do do your job. Good luck. Use at your own risk.
WARNING: These are NOT my ideas or words. The Information gathered here is from many different e-mail articles, news list, and other documents. I have not tested all of these ideas or web sites. The sites you are about to see, and utilities available to you may cause damage to your computer and your network. Some of these sites may have viruses, Trojans, intrusion software, java scripts, and informational revealing software. Some of the Utilities or Software may be against the law and/or illegal to down load and/or use. These sites my expose the vulnerabilities of your network, servers and workstations to hackers. There is no guarantee to the accuracy of this information. You need to try these changes out on a test computer or Test server first, and not on your live network. It is best if you visit these sites on a computer behind a firewall, with virus checking software and not connected to your live network. You must back up all data prior to implementing any of these changes. Use this information at your own risk.
Limitation of Liability. Under no circumstances including negligence, shall Dan Shea, or agents, be liable to you for any incidental, indirect, special or consequential damages (including damages for loss of business profits, business interruption, loss of business information, and the like) arising out of the use, misuse or inability to use this technical information documentation, breach or default, including those arising from infringement or alleged infringement of any patent, trademark, copyright or other intellectual property right, by Dan Shea, even if Dan Shea or authorized representative has been advised of the possibility of such damages. Dananne Enterprises Inc. will not be liable for 1) loss of, or damage to, your records or data or 2) any damages claimed by you based on any third party claim. In no event shall Dan Shea total liability to you for all damages, losses, and causes of action whether in contract, tort (including negligence) or otherwise) will not exceed the amount of $1.00 Canadian funds.

* * I hope this helps your computer learning experience * *

Extra Stuff Not Classified




3) Tecrepublic list of security white papers

4) - Kerberos in win2k winnetmag.com doc ID 7193
6) www.softwarebybay.com/product.asp?pid=50 The Information Security Course is the principle curriculum in this education series
8) Merak = mail server
9) FAQ: How Can I Ensure That Our Web Servers Aren't Enabled for IP Routing Between the Demilitarized Zone (DMZ) and the Internal Network? contributed by Jan De Clercq
A. On Windows NT systems, IP routing is disabled by default. To enable IP routing in NT, go to Network Settings, TCP/IP Properties. On the Routing tab, select the Enable IP Forwarding check box. You can also enable the feature from the registry. Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters registry subkey, and set the EnableIPRouter value (of type REG_DWORD) to 1. Reboot the system to effect the change.
14) The best way to block ad sites is to send the ad request from your Web browser to the host machine's loop-back address. To do this, add a 127.0.0.1 bad_ad_site.com entry in the host file of every machine on your network. Then, when a Web page contains a reference to an ad located on the bad_ad_site.com server, your browser will first consult the hosts file to locate the IP address before sending a DNS request for the ad site content. The request for content will appear blank in the browser, so no cookies or spyware will be loaded or accessed.
Rather than spending months developing your own list of ad servers to enter into your hosts file, you can use Gorilla Design Studio's list,
www.accs-net.com/hosts
which contains over 17,000 entries.
someonewhocares.org/hosts

18) MCP Artical on Security Audits 22 things to do.

20) Q. How can I create a Windows Server 2003 bootable CD-ROM that has Service Pack 1 (SP1) slipstreamed into it?
A. To create a bootable Windows 2003 CD-ROM, you first need to extract the boot sector of an existing Windows 2003 installation CD-ROM. (This procedure should also work to create a Windows XP bootable CD-ROM; simply capture the boot sector of an XP CD-ROM.) To extract the boot sector, I used the IsoBuster CD-ROM and DVD data-recovery tool, which you can download at list.windowsitpro.com
. After you install IsoBuster, perform these steps:
1. Insert the Windows 2003 CD-ROM that you want to integrate with SP1.
2. Open IsoBuster and select Bootable CD from the left pane, right- click the Microsoft Corporation.img file, and select Extract Microsoft Corporation.img from the context menu, as the figure at list.windowsitpro.com/t?ctl=8E2F:2E97
3. Enter a name for the boot sector you're extracting and click Save.
4. Exit IsoBuster.

Alternatively, you can use a pre-extracted Windows 2003 boot sector file called Windows2003StdCDBootSector.img , which you can download at list.windowsitpro.com/t?ctl=8E28:2E97F
Next, you'll create the new structure for the Windows 2003 with integrated SP1 CD-ROM by performing these steps:
1. Create a new folder on a local file system, and name the folder windows2003sp1.
2. Copy the contents of the existing Windows 2003 CD-ROM to the new folder.
3. Create an extracted version of the service pack that you want to slipstream (in this example, SP1). To do so, download the service pack, then execute it with the /x switch, as in the following example:
[name of service pack file] /x
4. Open the extracted service pack, navigate to the "update" subfolder, and run this command:
update /integrate: [path to copy of the Windows 2003 CD-ROM]
as in this example
update /integrate:D:\temp\windows2003stdsp1
You can also choose to not extract the service pack first and instead simply add the /integrate switch to the downloaded SP1 file, as in this example:
[name of downloaded SP1 file] /integrate: [path to copy of the Windows 2003 CD=ROM].
The integrate switch tells the update command to integrate the service pack files into an existing Windows 2003 installation source.
5. You can also update the support tools and deployment tools with their SP1 versions. (For download information, see the FAQ "Where can I get the updated support tools and deployment tools for Windows Server 2003 Service Pack 1 (SP1)?" at list.windowsitpro.com/t?ctl=8E2E:2E97F
Rename the downloaded deployment tools .cab file to deploy.cab and place the file in the \support\tools subfolder of the Windows 2003 CD- ROM folder that has the slipstreamed SP1 (replacing the existing deploy.cab file). To update the SP1 support tools, extract them to a new folder using the command
\c \t [location to extract to]
as in this example:
D:\temp\windowsserver2003-kb892777-supporttools-x86-enu.exe /c /t:d:\temp\2003sp1suptools
Copy the four extracted files (sup_pro.cab, sup_srv.cab, support.cab, and suptools.msi) to the \support\tools folder of the Windows 2003 folder.
You're now ready to burn this new structure and the boot sector you extracted earlier to a CD-ROM to make a bootable Windows 2003 CD-ROM that has SP1 slipstreamed into it. For this example, I used the Nero 6.6 CD-ROM burning software, but you can use any CD-ROM burner software that lets you create a bootable CD-ROM. To create the Windows 2003 CD- ROM, perform these steps:
1. Start the Nero or other CD-ROM burning application.
2. From the File menu, select New.
3. From the list of CD type options, select CD-ROM (Boot).
4. Select the Boot tab, then select "Image file" and enter the location of your boot sector image file. Check the "Enable expert settings" and set the emulation to "No Emulation." Set the load segment to 07C0 and the number of sectors to 4, as the figure at list.windowsitpro.com/t?ctl=8E2C:2E97F
5. Select the Label tab and enter the volume label of the original CD-ROM (e.g., NRMSFPP_EN for Windows 2003 Standard Server).
6. Under Burn CD, select the "Finalize CD (No further writing possible!)" option.
7. Click New.
8. Drag all the files from the Windows 2003 with slipstreamed SP1 folder to the CD project, as the figure at list.windowsitpro.com/t?ctl=8E2B:2E97F
9. From the Recorder menu, select Burn Compilation.
10. Click Burn.
The application then creates your SP1-integrated bootable Windows 2003 CD-ROM.

Resetting Windows Passwords with Knoppix Linux
Situation:
You have forgotten a local user password on a Microsoft Windows NT, 2000, XP, 2003 computer. This is especially useful if the forgotten password if for the ?Administrator? account.
What you?ll need:
A copy of KNOPPIX Linux. Any version should do fine, in my example I am using KNOPPIX 3.4 which is actually slightly outdated, but we don?t need any of the newer KNOPPIX features for this example.
If you have a Knoppix disc, you can download and use the ?chntpw? tool, which is a small program that lets you eset the local passwords on a Windows system, and return to your system.
First step is, obviously, to boot the computer with Knoppix. There are multiple ways to get chntpw, but luckily for us, it?s now part of Debian?s ?unstable? repositories. Since Knoppix is Debian based, we can get the latest .deb file from http://packages.debian.org/unstable/admin/chntpw. Download the file to your /home/Knoppix folder. Since most of the Knoppix system is read-only, we can?t directly install the .deb package. Instead, you must convert it to a tar file, and then extract out the chntpw utility. Open up a terminal and run the following commands:
Knoppix@ttyp1[knoppix]$ alien ?to-tgz chntpw_.deb
Knoppix@ttyp1[knoppix]$ tar xvzf chntpw.tgz ./usr/sbin/chntpw
Knoppix@ttyp1[knoppix]$ mv ./usr/sbin/chntpw ./
Once you have finished with these commands, the chntpw utility is in /home/Knoppix and ready to use. Now let?s reset the password!

To reset the password, you must have write permissions on the Windows partition. If you have a FAT or FAT32 Windows partition, this is easy. However, the standard and common file system for Windows NT, 2000, and XP is NTFS. So now I will explain how to mount your Windows partition using ?captive-ntfs?. As of Knoppix 3.4, Captive NTFS is included on the CD. Captive NTFS is actually a process that uses the NTFS drivers that Windows itself uses. Though it has worked for many people, it is still considered somewhat experimental, and anything of great importance should be backed up prior to use.

Knoppix includes an easy-to-use Captive NTFS wizard which will scan the hardrives for the necessary NTFS .dlls. Access the wizard by K-Menu -> KNOPPIX -> Utilities -> Captive NTFS. Click forward to see a list of the system files that Captive NTFS has already located on your Knoppix system. Click forward again, and the wizard mounts and scans your hard drives for the essential files it needs.

Once Captive NTFS has the module it needs, it activates the OK button even though it continues to scan other directories and partitions for drivers. If you are in a hurry, you can click OK to immediately mount the NTFS partitions. If you wait for the scan to finish, you are prompted with an option to specify locations for drivers, such as a USB flash drive, or click forward to download the drivers from the Windows XP service Pack 1.

Once you are finished with the wizard, you are ready to mount an NTFS partition. Open up a terminal and use the following command:

Knoppix@ttyp1[knoppix]$ sudo mount ?t captive-ntfs ?o uid=Knoppix,gid=Knoppix /dev/hda1

Obviously, replace the name of the partition, if it is not correct. The ?t option is used to specify file-system type, use captive-ntfs to use the NTFS drivers that the captive ntfs wizard previously found. The ?o argument tell mount to make user and group ?knoppix? the owner of this drive. Now that this drive is mounted, you have full read/write access to the drive and the possibly to do unlimited good and evil to your drive.
Make sure to unmount the drive after you?re done to be sure that changes are synced!!!!
Knoppix@ttyp1[knoppix]$ sudo umount /mnt/hda1

Now to continue resetting the password. Once the partition is mounted, we must find the directory containing the SAM file. For Windows 2000 and XP systems, this should be under /winnt/system32/config and /windows/system32/config, respectively. In this example, navigate to /mnt/hda1/windows/system32/config directory. You should see a number of files, including SAM, SYSTEM, and SECURITY that may or may not be in all caps.
Now, to reset the ?Administrator? password, do the
Knoppix@ttyp1[config]$ /home/Knoppix/chntpw SAM

You will see a few messages, and at the end should be prompted with an option to enter the new password. It is my strong recommendation that you simple reset(blank) the password by using the asterisk(*). I have not had good luck changing the password to something new, but blanking it works all the time from my experience. So, do the following:
Please enter new password: *
Hit [Enter]

There you go! You should now have a blank password on the local Administrator account of that Windows installation. If you want to reset the password for any account other than ?Administrator? you can use the following commands:
Knoppix@ttyp1[config]$ /home/knoppix/chntpw ?l SAM
To view all user accounts on the system

Knoppix@ttyp1[config]$ /home/knoppix/chntpw/ -u username SAM
To reset the account password for the username of your choice.
Once you have changed the password and saved your changes, unmount the filestem and reboot:
Knoppix@ttyp1[config]$ cd
Knoppix@ttyp1[knoppix]$ sudo umount /dev/hda1
Knoppix@ttyp1[knoppix]$ sudo reboot

As wayoutinva pointed out, renaming the amdin accoutn, give only the most marginal improvement in security. A much better solution is to create a named admin account (add to the admin group), and then diable the built-in admin account. Then it is not avaiable to be attacked. Don't worry, if you get in trouble and need it, boot to safe mode, and you can log in as the built-in admin account, even though it is disabled.
Microsoft is offering a public beta version of its upcoming Windows Live OneCare Family Safety, a free Web service that Microsoft says can help keep children safe from undesirable online content. The current beta version of the product features Web-content filtering and activity reports. You can learn more about the OneCare Family Safety Beta at the URL below.
list.windowsitpro.com/t?ctl=36EF6:25238

Disable NetBIOS and SMB to protect public Web servers As the connection between your internal network and the rest of the world, public Web servers always deserve an extra measure of protection. That's why you need to make sure you've disabled the services that are specifically for intranets.

The two biggest culprits that you need to worry about are the Server Message Block (SMB) protocol and NetBIOS over TCP/IP. Both services can reveal a wealth of security information and are reoccurring vectors for hacks and attacks.

Find out how to disable NetBIOS over TCP/IP and SMB on your public Web servers, and learn the consequences of doing so Serving data to users outside of an internal network, public Web servers are typically the first point of contact for an external attack. In addition, internal networking ports are the most revealing and most often attacked ports on a server. That's why you need to make sure you've disabled the services that are specifically for intranets. The two biggest culprits that you need to worry about are the Server Message Block (SMB) protocol and NetBIOS over TCP/IP. Both services can reveal a wealth of security information and are reoccurring vectors for hacks and attacks. They're unnecessary for the operation of a public Web server, and you should take steps to shut down both services on these servers.
Disable NetBIOS
NetBIOS was once a useful protocol developed for nonroutable LANs. In this case, it acts as a session-layer protocol transported over TCP/IP to provide name resolution to a computer and shared folders.
NetBIOS uses these ports:
• UDP 137: NetBIOS name service
• UDP 138: NetBIOS datagram service
• TCP 139: NetBIOS session service
Since external users—or hackers—don't need access to shared internal folders, you should turn off this protocol. To disable NetBIOS over TCP/IP, follow these steps:
1. Got to Start | Control Panel, and double-click the System applet.
2. On the Hardware tab, click the Device Manager button.
3. Select Show Hidden Devices from the View menu.
4. Expand Non-Plug And Play Drivers.
5. Right-click NetBios Over Tcpip, and select Disable.
6. Close all dialog boxes and applets.

This disables the Nbt.sys driver, which stops NetBIOS from listening to or initiating sessions over TCP 139. While SMB normally uses this port for communication, it will now switch to TCP 445—also known as the Common Internet File System (CIFS) port. That's why you need to disable SMB next.
Uninstall SMB
SMB uses TCP 139 or TCP 445—depending on which port is available. There's one way to disable SMB on a non-domain controller. However, I recommend completely uninstalling this service to prevent some well-meaning individual (or program) from re-enabling the service.
To uninstall SMB, follow these steps:
1. Go to Start | Control Panel, and double-click the Network Connections applet.
2. Right-click Local Area Connection (i.e., the Internet-facing connection), and select Properties.
3. Select Client For Microsoft Networks, and click the Uninstall button.
4. After the uninstall finishes, select File And Printer Sharing For Microsoft Networks, and click the Uninstall button.
5. Close all dialog boxes and applets.

Understand the ramifications
You've now disabled both SMB and NetBIOS. If an attacker manages to compromise your Web server, he or she won't be able to use NetBIOS or SMB to further explore and exploit your network.
Of course, security measures are often a balancing act of functionality and security. In this case, disabling these services takes away your ability to remotely manage Web servers through Active Directory's Computer Management console. However, you can still connect to and manage these servers through the Remote Desktop Client.
Final thoughts
While it's a common practice to block these ports at security boundaries, nothing beats disabling them on the machines themselves. Remember, as the connection between your internal network and the rest of the world, Web servers always deserve an extra measure of protection.
Rootkit Removal Tools
BitDefender RootkitUncover beta, from SoftWin
This tool is currently available as a free beta and looks promising, particularly because it's from SoftWin, makers of BitDefender.
list.windowsitpro.com/t?ctl=369CC:2E97F
DarkSpy, from DarkSpy Security Group
This tool is from a group of Chinese security researchers that I'm unfamiliar with. The download page for the tool says, "Use at your own risk," and you'd be wise to take that advice; however, it might give you a little comfort to know that this tool was recently mentioned in the SANS Internet Storm Center's Handler's Diary. Click the second URL under the Helios entry below to link to that mention.
list.windowsitpro.com/t?ctl=369DB:2E97F
F-Secure BlackLight
This is a standalone "trialware" tool, meaning that it periodically expires after a certain date--currently October 1. It's also a standard component of F-Secure's Internet Security 2006 package.
list.windowsitpro.com/t?ctl=369D6:2E97F
GMER, from an unknown independent Polish developer
Although no information is readily available about who developed this tool, its Web site has several screenshots and some movies (in ..wmv and .avi format) that show the tool in action. So you can get a good idea of what it's like before using it.
list.windowsitpro.com/t?ctl=369EB:2E97F
Helios, from MIEL e-Security
This is a new tool, currently in "alpha" development, that looks promising. For some good insight into Helios, go to the second URL below to read the SANS Handler's Diary entry for July 26, in which you can also see some screen shots of the tool in action.
list.windowsitpro.com/t?ctl=369E9:2E97F
list.windowsitpro.com/t?ctl=369DF:2E97F
IceSword, by Xfocus Team
IceSword has proven useful to many security administrators. Xfocus is a group of Chinese security researchers, and while the site is written in Chinese, you can use AltaVista's Babel Fish Translation engine (at the second URL below) to view it in English. You can also use Babel Fish to translate the Chinese documentation. list.windowsitpro.com/t?ctl=369E6:2E97F
list.windowsitpro.com/t?ctl=369EC:2E97F
RKDetector, by Miguel Tarasco Acuna
This toolkit comes in two parts: A file system analyzer and an Import Address Table (IAT) analyzer. The file system analyzer scans the file system and registry, and the IAT analyzer scans memory space for alterations that would allow rootkits to hook into the system. Screen shots are available to give you a good idea of what the tool looks like. list.windowsitpro.com/t?ctl=369EA:2E97F
RootKit Hook Analyzer, from Resplendence Software Projects
Although most rootkit detection tools look at kernel hooks, the file system, the registry, user accounts, and so on, this particular tool focuses exclusively on kernel hooks.
list.windowsitpro.com/t?ctl=369E1:2E97F
RootkitRevealer, from Sysinternals
A tool written by Mark Russinovich and Bryce Cogswell, two very well known Windows experts.
list.windowsitpro.com/t?ctl=369D4:2E97F
Rootkit Unhooker, from UG North
Although I have no idea who UG North is, the tool looks promising. It checks for unwanted processes and system hooks and can help terminate such processes.
list.windowsitpro.com/t?ctl=369E7:2E97F
Sophos Anti-Rootkit
This standalone tool offers both a GUI and a command line version and is similar to the antirootkit technology built into the Sophos Anti-Virus for Windows solution.
list.windowsitpro.com/t?ctl=369D0:2E97F
System Virginity Verifier, FLISTER, and KLISTER, by Joanna Rutkowska
These tools specifically look for hidden files and at various system components that might be modified by various rootkit techniques. Source code is included. Rutkowska is a well-known researcher.
ist.windowsitpro.com/t?ctl=369E0:2E97F
UnHackMe, from Greatis Software
While all the other listed tools are free, this tool is priced starting at $19.95 for a single license. You can view screen shots of the tool to see what it looks like and download a working demo if you're interested.
list.windowsitpro.com/t?ctl=369E8:2E97F

Antivirus Programs
Price: Free
Paid upgrade: avast! AntiVirus Professional
Info: www.avast.com
Price: Free
Paid upgrade: AVG Professional Edition
Info: free.grisoft.com
Price: Free
Paid upgrade: AntiVir Personal Edition Premium
Info: www.free-av.com
Anti-Spyware
Spybot Search & Destroy
Price: Free
Paid upgrade: None
Info: www.safer-networking.org
Price:
Paid upgrade: Ad-Aware SE Plus & Pro
Info: www.lavasoft.de
Price: Free

To use the Linux DD function to wipe a hard drive clean, you can utilize the following command:
# > dd if=/dev/urandom of=/dev/hda
where
/dev/hda
is the physical address of the analysis drive, and urandom is the built-in “random” number generator from Linux. This process should be repeated as many times as you desire. Many professionals sanitize their hard drives as many as three to nine times.
You can use CACLS and XCACLS to gather information on files that are a reflection of the NTFS permissions you have configured. These tools will deliver data about the permissions for specific file and folder resources. What's the difference between NTFS permissions and an ACL (access control list)? The NTFS permissions are set in Windows Explorer or via an automated mechanism for files and folders, whereas an ACL (via these tools) is a display or management of allowed or denied file operations for the same resource.

You can use CACLS and XCACLS to add or remove NTFS permissions in a scripted fashion as well. So if you have a great deal of permissions to adjust, a sophisticated script using these tools may be in order.

A good matter of practice for important shared files and folders with unique NTFS permissions is to make a script utilizing the CACLS.EXE tool to document the ACL for individual files and folders (or manually execute the steps to do this). But be careful: You can easily document your NTFS permissions by running "CACLS * /T" from a command prompt and document a folder, its contents, and subdirectories. This is very resource intensive and can require 100% CPU utilization on some systems when traversing extremely large folder paths. Depending on many factors, a large recursive ACL audit can take large amounts of time as well. This is similar to the scenario where new NTFS permissions are propagated to a large folder.

Q. How can I use Group Policy to hide the domain drop down list on the Windows Logon dialog box?
A. By default, when a user logs on to his or her Windows system, a list of domains is displayed from which the user can select which domain to use for account authentication. If you want to hide the list of domains and force the user to enter the domain as part of the username field, you can do so via a registry change, but no Group Policy setting exists by default. However, you can create the following .adm template file and import it to a Group Policy Object (GPO) to facilitate the suppression of the domain drop-down list:

CATEGORY "Logon Settings"
KEYNAME "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

POLICY "Hide Domain UI"
VALUENAME "NoDomainUI"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY
END CATEGORY

After you import the .adm file into a GPO (and ensure that it's visible by turning off the managed only policy view), enable the setting, as the figure at
list.windowsitpro.com/t?ctl=3599A:2E97F

Best of Redmondmag.com: Security Product Reviews DeviceWall http://redmondmag.com/reviews/article.asp?EditorialsID=537 * ipMonitor 7.5 http://redmondmag.com/reviews/article.asp?EditorialsID=526 * NetChk Protect http://redmondmag.com/reviews/article.asp?EditorialsID=531 * Patch Manager 4.0 http://redmondmag.com/reviews/article.asp?EditorialsID=521 * Quest Group Policy Manager 2.5 http://redmondmag.com/reviews/article.asp?EditorialsID=535 * Specops Password Policy http://redmondmag.com/reviews/article.asp?EditorialsID=538 * ThreatSentry 2.0 http://redmondmag.com/reviews/article.asp?EditorialsID=516 * DeviceLock and Safend Protector http://redmondmag.com/reviews/article.asp?EditorialsID=530 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
• ** Don Jones' Tip Sheet #108: Migrating User Settings A user on ScriptingAnswers.com recently asked if there was a way to write a script which would move a user's settings, preferences and documents from an old PC to a new one. That'd be quite a script to write: You'd need to scan for the files, export hundreds of registry keys and do heck knows what else to successfully apply everything to the new PC. However, a script would be easier than trying to use the File & Settings Transfer Wizard on a few dozen machines, which is what the reader was faced with. Which is proof that VBScript -- or any tool, for that matter -- isn't the right tool for every job. In this case, the right tool is the User State Migration Tool (USMT), currently in version 2.6, which is free from Microsoft. It's usually on the Windows product CDs, but you can download it from http://tinyurl.com/3swfw for the latest version. It's essentially two tools, Scanstate and Loadstate, which provide the same functionality as the File & Settings Transfer Wizard, but in a scriptable, command-line format. Use Scanstate to bundle a user's stuff into a migration file, and Loadstate to apply the file to a new PC. An .INF file provides pretty granular control over what gets migrated (USMT comes with five sample files for different migration scenarios), such as applications, system settings and so forth. Best of all, USMT works on everything back to Windows 95 for source systems and Win2000 and WinXP for destination systems. ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++ Renaming the Administrator account in Windows XP The Administrator account exists on all computers running Windows XP Professional and Home. This gives potential hackers, half the information they need to access your computer—all they have to do is guess your password. You can make it more difficult for unauthorized persons to get into your system by renaming the Administrator account. Follow these steps for a Windows XP Pro machine: 1. Go to Control Panel and open Administrative Tools. Double-click the Local Security Policy. 2. When the Local Security Settings snap-in appears, open the Local Policies\Security Options branch and double-click the Accounts: Rename Administrator Account policy. 3. When the Accounts: Rename Administrator Account Properties dialog box appears, type a new name in the text box, and click OK. Follow these steps to rename the Administrator account in Windows XP Home: 1. Press [Windows]R to access the Run dialog box. 2. In the Open text box, type Control userpasswords2 and click OK to access the User Accounts dialog box. 3. Select the Administrator Account from the list and click the Properties button. 4. In the User Name text box, type a new name, and click OK. Note: This tip applies to both Windows XP Home and Professional editions. +++++++++++++++++++++++++++++++++++++
An HTTPS Web site may make most users feel relatively secure, but this alone doesn't guarantee secure transactions. To properly protect your organization's users—as well as corporate data that unsecure transactions could leave open to exposure—make sure your users understand how to properly evaluate a Web site's security. Making the SSL connection When it comes to online forms, secure servers (from an HTTPS site) do not actually serve most of them. This means that the form data may not be going where users think. If you view the source HTML code of a Web page that you're entering credit card data into, you should see something like the following:
or If the form POSTs to an IP address, users should browse to another site. A Web site should send sensitive information only to a registered site. Here are the four most common forms that users will encounter: • Form page http://www.shop.com/form.html with a form tag of : This is not secure at all, and it doesn't encrypt any of the information. • Form page https://www.shop.com/form.html with a form tag of : This information isn't secure either. When the form sends the data, it initiates a new—not secure—HTTP session. • Form page http://www.shop.com/form.html with a form tag of : This securely transmits information to the form Web site. • Form page https://domain.com/form.html with a form tag of : This also securely transmits information to the form Web site. Making sure data remains secure By securely transmitting data and using SSL to collect sensitive information, a Web site implies that it will keep that information secure. But what really happens behind the Web site? For example, most small companies don't host their own Web sites; instead, they use a Web hosting service. But Web hosting services typically turn that Web form data into an e-mail, a process that more than likely doesn't encrypt the data. This means that anyone with access to the e-mail can easily access customers' sensitive information. Advise users to keep this in mind when surfing the Web, and make sure your organization's Web site makes an effort to reassure its customers about data security. ++++++++++++++++++++++++++++++++++++++++++++++++++++++
Myth No. 2: Complex Passwords Enhance Security Your company probably has a policy that mandates complex passwords. For example, they may require a combination of uppercase and lowercase letters, numbers and special symbols. Windows even includes a Group Policy setting to enforce complex passwords. To understand why this doesn't enhance security and can even lower it, you have to look at what makes a good password in the first place. Any password requirement should ensure that an attacker can't crack it before it becomes invalid or out of date. For example, if you require users to change their passwords every 90 days, it should be extremely unlikely that anyone could succeed at cracking a password within that time. Many old computers allowed passwords made up of only letters, didn't differentiate between lowercase and uppercase letters and limited passwords to just a few characters. Using the 26 characters of the alphabet and allowing for six-letter passwords, there are 300 million possible passwords. This provided adequate security on systems that required manual log-on because it would take an attacker too long to enter enough combinations to find the correct password. Increasing password length to eight characters increases the number of possible combinations to more than 200 billion. Even this has proved inadequate against automated attacks, however, especially offline brute-force attacks that calculate hash values from all possible combinations and compare the results with a captured hash of the target password. These types of attacks quickly crack any password with single-case characters. The only way to truly prevent someone from guessing or cracking your password is to increase the number of different characters within a password--distinguishing between uppercase and lowercase, allowing numbers and special characters. This increases the number of available characters from 26 to roughly 80. Combining eight of these characters creates more than 4 quadrillion combinations, and greatly increases the time required to crack a password. The problem with using excessively complex passwords is that users may be more tempted to write them down, which completely defeats the purpose, no matter how stringent your password requirements. Windows also lets you use longer passwords that may contain spaces and other punctuation characters. This allows for the use of pass phrases, which are "passwords" made up of multiple words. Typing a phrase when logging on may require a few extra keystrokes, but it may actually take less time than locating some special characters on the keyboard. By combining pass phrases with punctuation marks, or small changes to words, you can create even more complexity. Even better, pass phrases are easier to remember and so are more easily accepted by users. They are also less likely to be written down. Unfortunately, not all systems allow for pass phrases. If password length restrictions don't prevent the use of pass phrases, you should consider transitioning to them soon. Doing this not only increases security but makes your users happier with the password guidelines. There are more security myths making the rounds that you'll read about in future Security Advisor columns. For now, I hope that debunking two of the most popular myths will help you increase your password security and not fall victim to inappropriate trust in SSL. Joern Wettern, Ph.D., MCSE, MCT, Security+, is the owner of Wettern Network Solutions, a consulting and training firm ++++++++++++++++++++++++++++++++++++++++++++++++++++++

Place operations masters in your domain Generally, you don’t have to do anything to create operations masters in your domain; the process of creating them is automatic and transparent. By default, the first domain controller in a forest is the Schema Master and Domain Naming Master for the enterprise. The first domain controller in each domain is the PDC Emulator, RID Master, and Infrastructure Master for the domain. So, in other words, the first domain controller in a single-domain forest will hold all five operations master roles. Although the operations master roles are assigned automatically by default, you can significantly improve the performance of Active Directory by strategically placing operations masters. We recommend you do the following: You should assign the Schema Master and Domain Naming Master roles to the same domain controller. This domain controller should also be a global catalog server, because both operations masters need to contact a global catalog server in the course of their duties. Ideally, you should assign the PDC Emulator and the RID Master roles to the same domain controller. But, if you find that the workload of both roles is too great for the domain controller, or you want to avoid having a single point of failure for both roles, you can place these two roles on separate domain controllers. One caveat: these two domain controllers must be well-connected, meaning the link between them must be high-speed (such as a LAN link). Don’t assign the Infrastructure Master role to a server that’s also a global catalog server. Doing so causes the Infrastructure Master to function improperly. Because the Infrastructure Master queries the global catalog to find out-of-date information before performing an update, if the Infrastructure Master is also a global catalog server, it won’t ever find out-of-date information. Thus, the Infrastructure Master won’t ever replicate updates throughout the domain. You should assign the Infrastructure Master role to a domain controller with a direct connection object to a global catalog server within the site whenever possible. Doing so improves the performance of the Infrastructure Master (and thus the replication of updates). What about the global catalog server? Although the global catalog server isn’t an operations master, this server can also have a tremendous impact on Active Directory’s performance—especially if you have multiple sites. A global catalog server contains a full replica of all Active Directory objects in its domain. It also contains a partial replica of all objects in other domains. A global catalog server facilitates user logons and access to Active Directory data from different domains. By default, Windows Server 2003 automatically creates one single global catalog server per forest. If you have multiple sites, we strongly recommend that you create a global catalog server at each site to speed up users’ access to Active Directory data. This strategy helps you avoid having users’ Active Directory queries processed across WAN links. ++++++++++++++++++++++++++++++++++++++++++++++++++++++
Q. For which domains do you need to run the Microsoft Exchange Server 2003 DomainPrep process? A. You must run ForestPrep once for each Active Directory (AD) forest. Additionally, you must run the DomainPrep for the following domains: - The root domain - Domains that will contain Exchange 2003 servers - Domains that will contain Exchange 2003 mailbox-enabled objects (such as users and groups), even if no Exchange servers will be installed in these domains - All domains that contain Global Catalog (GC) servers that Exchange directory access components might use - All domains that will contain Exchange 2003 users and groups that you'll use to manage your Exchange 2003 organization You must be a domain administrator to run Exchange domainprep but no Exchange permissions are required.
http://support.microsoft.com/kb/918005/?sd=RMVP&fr=1
"Windows 2000 Computer Startup Scripts." I have heard of other administrators running a simple Net User command, such as net user administrator pass123456, which would set the local administrator password to pass123456. For security reasons, this, of course, is never recommended.
SysInternals offers a free too called PsPasswd, which allows you to remotely reset passwords on a range of computers on your network. The tool will also report successes and failures of changed passwords, and allows you to run a single command against a list of computers
http://www.thekurt.net/NetworkUtilities.htm
Tools like S-Tools, JP Hide-and-Seek, and Gif-it-up were free and powerful and could be used to hide information in digital images by anyone willing to simply download the software.
Chris: I was just asked to audit user Internet history for a small office client. They don't have nor want a proxy server and connect to the Internet using a Linksys WRT54G router. I've tried to copy a user's Internet Explorer history and read the history data locally, but that only allowed me to read portions of a user's browsing history. Is there any script or tool that you can recommend to help?
--James
James: Ideally, you want to implement a perimeter device that can audit user Internet activity in real time. Since the office connects to the Internet via a Linksys router, you could consider replacing the default Linksys firmware with OpenWrt http://openwrt.org/ . OpenWrt is open source and adds many more features to the standard Linksys router. For example, you can load the open source Squid proxy onto the router and add VPN functionality as well. Since users can clear their Web browsing history, auditing Web activity externally such as via a Squid proxy server will give you better control of monitoring Web abuse. Not too long ago, accountants and legal assistants, for example, could work without any external network access. Today, many small business network administrators don't need any monitoring tools for their Internet connections. Instead, they can always rely on their users to notify them within seconds of any Internet failure.
As a user, it's easy to see your Internet Explorer history by navigating to the C:\Documents and Settings\\Local Settings\History\History.IE5 folder. From there, you'll see history organized by day of the week for the current week, as well as by subfolders for previous weeks. When browsing other user profiles, Windows Explorer's view of the profile isn't as intuitive. Instead, you will see folders whose names are based on the historical dates that they represent. A folder named MSHist012007010220070103 contains historical data from Jan. 2, 2007 (20070102) to Jan. 3, 2007 (20070103). Within each folder is a file named index.dat. The index.dat file contains the actual history data. Viewing this file in a text editor such as Notepad will reveal much of the history information, but it is difficult to read. An easier way to read history data from any user's profile is by using the tool Index Dat Spy http://tinyurl.com/dfcpc .
Index Dat Spy is free and installs in a few minutes. To use the tool, just copy the user's IE history folder (example: C:\Documents and Settings\dmcnabb\Local Settings\History\History.IE5) to a local folder on your system or to removable media such as a USB drive. Note that each user's Local Settings folder is hidden by default, so you will need to enable the hidden files view in order to see this folder. To see hidden files, in Windows Explorer click the Tools menu, select Folder Options, and then click the Show Hidden Files and Folders radio button.
One you have access to the user's History.IE5 folder, follow these steps:
1. Open Index Dat Spy.
2. In Index Dat Spy, click the File menu and select Open.
3. Browse to the copied History.IE5 folder, select the Index.dat file located within that folder, and click Open.
You should now see the user's Internet history displayed. Without an external Internet usage auditing product such as a proxy server, Index Dat Spy can be a pretty handy tool for viewing a user's Internet Explorer history data. Now, the next time a user complains that "The Internet is down," you can cleverly reply, "Don't worry. You'll have your access to insert embarrassing Web site name here> in no time!"
What is auditing?
Auditing simply allows you to track events and user actions on your network. Some of the possible events you might keep track of include:
• Logins
• Mapping drives
• Resources used
• Identification of the users
• Dates and times of events
• Accessing sensitive material
• System tasks
• Application launches
• Storing files on a hard drive
• Modifications of user accounts
Of course, there are many other items or actions you might consider auditing, but beware of tracking too much. You can easily overwhelm your system's resources and your own ability to use the log files if you're tracking too many items. Each item you decide to track requires some part of each system's resources. If you do too much auditing, users can't access the resources they need to complete their work; not enough, and anyone may be accessing your network with less than good intent. Each network requires a different level of auditing to maintain a secure working environment that functions properly. Your job is to walk the line between protection, resource planning, and user demand when balancing your network's resources.
First step: Use WEP as the foundation
Despite the fact that he found major flaws in WEP, Wagner said it is very important that you use its encryption system as a foundation for good security.
"Surprisingly, a large proportion [of companies] deploy wireless networks without any encryption. So that is the first serious mistake that you can make," Wagner said.
"If you don't have WEP enabled—if you don't have [any] encryption enabled—[you are susceptible to] very serious attacks that require almost no sophistication. So the very first thing that you'd better do if you have a wireless network is...use encryption."
Second step: Isolate the WLAN and enhance encryption After enabling WEP, you should also consider other security measures in order to compensate for its vulnerabilities. Wagner suggested a couple of steps to work around the potential problems of WEP.
"[First,] place your wireless network outside of the firewall. Treat it just like you would the rest of the Internet," Wagner said. " ...recognize that it can't be trusted and anything could happen on it, so you [should] firewall it off from all of your sensitive corporate secrets."
Next, he said to use a virtual private network (VPN) for all traffic on the WLAN. The VPN will do its own end-to-end encryption on top of WEP. You can use such popular VPN protocols as PPTP and IPSec to accomplish this. Then, set up a VPN server/router that connects the WLAN segment to your LAN segment.
A cheaper, but less safe, alternative
Wagner admitted that the above solution might be too costly for some businesses, so he offered another suggestion that provides a limited defensive strategy.
First, it is important to understand that in WEP, there is a signal encryption key that's configured identically for everyone who is supposed to have access to the wireless network. Usually, this key is set up once when the password is handed out and often stays the same for months or years. That said, Wagner suggested that the wireless system employ extensions to WEP that perform dynamic key changes and modify the wireless encryption key once every 10 minutes.
"The problem is that once someone can break it, they've got everything," Wagner said.
"So [by] changing the key once every 10 minutes, you can ensure that if they use this attack against you, they only get something that's...10 minutes worth of data. And second of all, changing the key frequently makes it hard to mount [WEP] attacks."
http://www.download.com/StaticX/3000-2162_4-10602490.html
http://www.chrisnowell.com/windows-security-tool/
James: Ideally, you want to implement a perimeter device that can audit user Internet activity in real time. Since the office connects to the Internet via a Linksys router, you could consider replacing the default Linksys firmware with OpenWrt http://openwrt.org/ . OpenWrt is open source and adds many more features to the standard Linksys router. For example, you can load the open source Squid proxy onto the router and add VPN functionality as well. Since users can clear their Web browsing history, auditing Web activity externally such as via a Squid proxy server will give you better control of monitoring Web abuse. Not too long ago, accountants and legal
Takeaway: With the Exchange Management Shell, there are some things that you can do only from the new command line interface.
Like it or not, Microsoft has put a whole ton of effort into making Exchange 2007 completely manageable via a Windows PowerShell-based management interface. In fact, there are some things that you can do only from the new command line interface--not even the GUI can handle these tasks. The Exchange Management Shell, as it's called, is based on Windows PowerShell, which started with the code name Monad. The shell includes very good help features, but, with the complexity of Exchange itself, can get pretty complicated to use. I’m not going to get into providing shell examples in this tip (I will in future tips, though), but will share with you some things that may make using the shell easier.
To get started in the shell, go to Start > All Programs > Microsoft Exchange Server 2007 > Exchange Management Shell. This opens a window that looks a lot like a normal command window but, instead of using the old cmd.exe in the background, this is the new, rather plain-looking PowerShell.
To get a list of Exchange specific commands in the shell, type get-excommand. For a quick guide to getting started with the shell, use the command quickstart instead. As I mentioned, the command shell can be fairly complex, but Microsoft tries to ease this complexity by, for some functions in the GUI command tool (Exchange Management Console), providing you with the complete command line syntax that would have performed the same job. For example, when you use the new mailbox wizard in the GUI, the summary page of the process outputs the command shell syntax. This can be incredibly useful if you want to ultimately be able to script Exchange events. The new command shell is a very welcome addition to the Exchange tools family and makes Exchange management very flexible while providing administrators with a way to automate important functions.
How about having one server get its time from USNO or NIST, then syncing all servers and clients sync to the server, accounting for time spent hopping and time zone. I like World Time by Paw Print.
The importance of protecting network access
Every computer that connects to your local area network poses a potential threat. If it’s infected with a virus or spyware, if it doesn’t have adequate firewall protection, has had the latest security updates and patches installed, etc., the entire network can be placed at risk. You have some control over the on-site computers, but what about those that connect to the LAN via remote access, or the laptops that employees bring to work with them after having connected them to home or public networks?
To protect your network, you should set policies requiring that before it can connect to your LAN, a computer has to meet minimum "health" standards. But you can’t always trust users to comply voluntarily, so you need an enforcement mechanism that can determine whether a system meets the standards and prevent it from connecting, or restrict its access, if it doesn’t. That’s where NAP comes in; it’s Microsoft’s health policy compliance platform.
CRAFT YOUR OWN INTERNET USAGE POLICY WITH THIS SAMPLE
The Internet is an important resource for your customers and employees. It is imperative that you inform your users about the purpose and use of the company Intranet and Internet. By educating your users and setting out a clear policy, you'll gain a valuable ally in protecting company assets when users are on the network. The guidelines I present here are generic and should be modified to fit your business model.
Legal liability
Still other employees may surf inappropriate adult sites that, if enabled by management and witnessed by others, could constitute grounds for harassment claims. Or, employees using organization-provided Internet access could knowingly (or unknowingly) violate international copyright law, which could further expose the organization to liability.
Internal penetration testing
A 2004 study conducted by the FBI and the Computer Security Institute revealed that internal attacks account for more than 50 percent of all organized network security breaches. Because most successful attacks are coming from connections that are inside your perimeter security, common sense says this is where you should perform the bulk of your testing.
Conduct testing from different network access points, and include each logical and physical segment. In addition, pay specific attention to wireless coverage that extends beyond the boundaries of your physical perimeter. Social engineering
No penetration test would be complete without addressing this nontechnical approach to exploitation. Social engineering preys on human interaction to obtain or compromise information about an organization and its computer systems.
In a social engineering scheme, the attacker relies on human nature to gain access to unauthorized network resources. This could be in the form of eavesdropping or "shoulder surfing" (i.e., direct observation practices) to obtain access. It can also include data aggregation through "dumpster diving" (e.g., looking for passwords written on sticky notes) or talking to multiple sources and building on data from each source until the attacker has enough information to commence an attack.
http://www.hping.org/
http://www.nessus.org/download/index.php
• Vulnerability Scan tests for more than 3,000 vulnerabilities
• Custom Security Compliance Report addressing your compliance with regulations such as HIPAA
• Certificate of Compliance addressing Payment Card Industry (PCI) requirements for VISA, American Express & MasterCard compliance
• Security Consultation Service can be arranged with a Rackspace Security Professional to review your audit and plan corrective measures
• Vulnerability scan tests for more than 3,000 security vulnerabilities within your environment
• Customized security compliance questionnaire extensively reviews compliance requirements for regulations such as:
• Payment Card Industry (PCI) Data Security Standard
• Health Insurance Portability and Accountability Act (HIPAA)
• Sarbanes-Oxley (SOX)
• Gramm-Leach-Bliley Act (GLBA)
• Federal Information Security Management Act (FISMA)
• Statement on Auditing Standards Number 70 (SAS-70)
• Detailed security compliance report that indicates compliance status, prioritizes vulnerabilities and provides recommended courses of action
• Vulnerability scan tests for more than 3,000 security vulnerabilities within your environment
• Customized security compliance questionnaire extensively reviews compliance requirements for regulations such as:
• Payment Card Industry (PCI) Data Security Standard
• Health Insurance Portability and Accountability Act (HIPAA)
• Sarbanes-Oxley (SOX)
• Gramm-Leach-Bliley Act (GLBA)
• Federal Information Security Management Act (FISMA)
• Statement on Auditing Standards Number 70 (SAS-70)
• Detailed security compliance report that indicates compliance status, prioritizes vulnerabilities and provides recommended courses of action
External Links
iEntry may have (hypertext) links to other unaffiliated websites. Linking to such websites is at your own risk. iEntry has not reviewed all of the content of such linked websites and is not responsible for the content of any such linked website. Any (hypertext) links contained on this website shall not be construed as an endorsement by iEntry of any such linked website. Promotions Any promotional content contained on this website is subject to inventory availability. iEntry reserves the right to cancel or modify any such promotion at any time and without notice.
Disclaimer
THE CONTENT OF THIS WEBSITE IS PROVIDED "AS IS" WITHOUT ANY WARRANTIES OF ANY KIND INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT OF INTELLECTUAL PROPERTY. Although iEntry uses reasonable efforts to maintain the accuracy and currency of the Content of this website, iEntry makes no warranties or representations as to its accuracy or currency. This website may contain typographical errors and technical inaccuracies. iEntry assumes no liability or responsibility for any errors or omissions in the content of this website. Although iEntry uses reasonable efforts to ensure that all software provided at this website, or as a link from this website, is suitable for use on a wide variety of computer systems, you should take reasonable and appropriate precautions to scan for computer viruses and ensure compatibility of the software with your specific computer system. iEntry may update and/or modify the information contained on this website at any time and without notice. Limitation of Liability IN NO EVENT WILL iEntry, ITS AFFILIATES, SUPPLIERS OR OTHER THIRD PARTIES MENTIONED IN THIS WEBSITE BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES RESULTING FROM LOST PROFITS, LOSS OF PROSPECTIVE ECONOMIC ADVANTAGE, LOST DATA OR BUSINESS INTERRUPTION) ARISING OUT OF THE USE, INABILITY TO USE, OR THE RESULTS OF USE OF THIS WEBSITE, ANY WEBSITES LINKED TO THIS WEBSITE, OR THE CONTENT CONTAINED ON ANY OR ALL SUCH WEBSITES, WHETHER BASED ON WARRANTY, CONTRACT, TORT OR ANY OTHER LEGAL THEORY AND WHETHER OR NOT ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, OR FOR ANY CLAIM BY ANOTHER PARTY. IF YOUR USE OF THE CONTENT ON THIS SITE RESULTS IN THE NEED FOR SERVICING, REPAIR OR CORRECTION OF EQUIPMENT OR DATA, YOU ASSUME ALL COSTS THEREOF.
The can antenna wireless
Operations managers = $58,000 to $70,000
System administrator = $48,000 to $70,250
Data security professionals = $71,750 to $102,000,
Burnout is the exhaustion of physical or emotional strength or motivation and is usually a result of prolonged stress, frustration, or intense activity. People who feel both overworked and under-appreciated are especially prone to burnout; however, even the most competent multitasker is susceptible. One of the simplest, most effective methods of preventing burnout is to take a time-out. 10 signs of impending burnout
Here’s a checklist of some key symptoms that will help you identify when it’s time to take a break:
1. Compromised professional and personal relationships.
2. Inability to focus on your work, especially in front of an audience.
3. Feelings of apathy about the integrity of projects.
4. Frequent emotional outbursts and mood swings.
5. Lack of concern about the consequences of your actions.
6. Sleeping problems, such as restlessness, nightmares, and insomnia.
7. Frequent physical ailments, such as headaches, heartburn, fatigue, and body pains.
8. Inability to relax and not think about work during nonworking hours.
9. Feelings of helplessness, hopelessness, and low self-esteem.
10. Obsessing about problems rather than developing solutions.
The act by which an attacker convinces a person in a company to give up confidential information or take an action that compromises company security is known as "pretexting," or "social engineering." defines it as "getting people to do things they wouldn't ordinarily do for a stranger."
Unfortunately, advanced hardware and software security systems can still be defeated, even if unintentionally, by humans within that company.
All warfare is based on deception
Things may not be what they appear to be. Unfortunately, the desire to be helpful and trusting leads people to give out information to those they don't really know. Just because someone says he or she is from the same company doesn't necessarily make it so.
"I'm sorry, but I need authorization before I can give out that information."
"We've had issues previously with forged signatures."
I'm sorry, I'd really like to help, but I'm limited in what I can do."
http://www.bankruptcy-canada.ca/?gclid=CJjEorXk24kCFQRIPgod7mZG-A
Add a Safe Mode option to the Boot menu in Windows XP
Follow these steps to add a Safe Mode option to the Boot menu.
When you're experiencing a problem with Windows XP, you may need to boot the system into Safe Mode more than once. However, doing so can be a tiresome process. When the Boot menu appears, you must press [F8], and then you must select Safe Mode from yet another menu.
Wouldn't it be nice if Safe Mode were available from the Boot menu? In fact, it's relatively easy to add a Safe Mode option to the Boot menu.
Here's how.
1. Press [Windows][Break] to open the System Properties dialog box.
2. On the Advanced tab, click the Settings button in the Startup And Recovery section.
3. In the System Startup section, click the Edit button.
4. When the Boot.ini file opens in Notepad, locate the line that ends with the /fastdetect switch.
5. Highlight and copy that line and paste it in the line below.
6. Change the section on the line that reads WINDOWS="Microsoft Windows XP Professional" to WINDOWS="Safe Mode."
7. Add the following to the end of the line:
/safeboot:minimal /sos /bootlog

http://fbi-sos.org/
Back To Main Page
Updated February 3, 2007
Copyright© 2007 by Dananne Enterprise Inc.

Copyright© All rights Reserved. No part of the contents of this site may be reproduced
or transmitted in any form or by any means without written permission.
Any questions or problem links please email