said by Tazmo :

Mr. "Z"

Your efforts and the time you've taken to explain the use of this tool are much appreciated. However, there are a couple of questions or concerns I have that I hope you will address. As a senior citizen I'm not exactly a computer geek, although I try my best to keep up.

..Thanks

Perhaps you addressed this earlier and I just flat missed it...but is it absolutely necessary to create a partition on the boot drive, or can't you simply point to a different physical drive as the place for SCT to save it's images?

..No You can place the un-partitioned space on another drive. When you download the toolkit, you can read the handbook which is in PDF format.

..Installing the toolkit does not automatically activate it, however you might wish to create another ADMIN prior to downloading it, so that this ADMIN user id will be only for the Toolkit administration once you activate it.

If this is possible, would you then need to create a partition on this separate drive? Also...just how much of the user's account info must be moved? (In my case, I must confess that I only use Admin as my account, although I do use "Drop My Rights" to run my browser.)

..Using the profile manager with the toolkit, you can leave things where they are, it allows user profiles to be located on other drives besides C:, so this is not a problem.

The reason I ask is that like a lot of home users, I have WinXP on my C:\ drive and my data on my D:\ drive. I have moved some account info to my D:\ drive, such as My Documents and Favorites. What else would I need to move there and does SCT offer a tool to do so?

I have one other computer on my home network which is behind a router. Would SCT force me to change read/write permissions in any way?

..No, there won't be a problem there at all.

And finally...it would seem this tool would be moderately tricky to install and use for the average home user...to say nothing of the disk space that needs to be given up. If one is using good AV and Spyware real-time scanners and doing regular backups...what advantages would be gained by this tool?

..The toolkit can be turned on and off, very easily, however the user restrictions will stick until removed, so this is another reason to create some new users for testing, so you can play around and if needed disable/enable it easily.

..You should really create Three new users while testing:

..1. A toolkit Admin ID, only used for changing the Toolkit settings. Also Install the Toolkit using this ID.

..2. Another Admin ID that you can play with restrictions on.

..3 Another Limited User ID that you can play with restrictions on

..This way, you won't loose any current functionality unless you logon as these other ID's and you can pace yourself to best suit your time and learning curve.

..If you did not do this and set your current user ID too restrictive, you may end up cursing a lot, this way is much less stressful.

..I think part of the problem with backups is much like the restore point infection problem. If you are lucky enough to have a backup prior to being infected, of course you could recover. You might need to restore many backups to check when you were infected, that could take time, worse case, what if you can't find a clean backup?

..Because this is really protection on a disk basis, when properly set up, it's almost impossible to get infected in any way, also it would be impossible to make an accidental deletion or change as well.

..Recovery time would be the largest benefit as well as being protected from ALL malware, including Zero-Day and accidental deletions or changes.

I do regularly scheduled backups, and because of this have no problems, for example, if the grand kids want to play on my computer. If they mess something up (as they have on occasion), I simply revert to my most recent backup.

Don't get me wrong, this seems like a great program. I'm just having difficulty determining if the pain of installation and use is worth the gain over what I'm doing now.

..I think you will be surprised, you can pace yourself by using these additional user ID's for the moment, and this way not feel forced to a time line. The sense of peace you will get by being protected at this level, might amaze you. Of course I would still run an A/V and A/S packages if I were you, but they play more of a secondary role now, but still well needed.

Thanks.

..Your very welcome, if you have any other questions, or if I did not explain these very well, please ask away. I think it is important to note that downloading and installing the MSCT really does not Auto-Invoke anything minus the "User Hive Cleanup" which is really more of a bug fix anyway. Personally, I think, it is important to create a NEW Admin account to use when installing the Toolkit because it becomes kind of a Super Admin, and has additional privileges.

said by vukodlak75 :

I've only been using the WDP part of the toolkit.
Just today I've been playing with restrictions. I have a question about the autologon script.
How can I enable it for an account name of T&M Sisters?
When I try I get this:
C:\Program Files\Microsoft Shared Computer Toolkit\scripts>autologon.wsf /enable T&M Sisters password
'M' is not recognized as an internal or external command,
operable program or batch file.

C:\Program Files\Microsoft Shared Computer Toolkit\scripts>

said by Cudni :

* When Windows Disk Protection is enabled and the protection partition is full, the end user will be prompted to save files to a different location and restart the computer.

said by vukodlak75 :

Are there certain profiles that can't be restricted?
For example, I cannot select Guest, Administrator and obviously the current user logged on.

said by johnmac785 :

Zoverlord..

Actually, I understand how to get to the restricting users screen. Maybe I did not explain the problem correctly.

When in that portion of the program, I cannot select the user I want to restrict. All users are on the pop-up that comes up when you click on select user to restrict, but I can not highlight and restrict the user of my choice.

Hope this is a better explanation of the problem.

Thanks for your help.

John

said by johnmac785 :

I am trying to install toolkit and have gotten as far as restricting users. As soon as I try to restrict a user, it does not allow me to choose that user and make the restrictions.

They are on the popup, but will not highlight to select them.

Any suggestions?

Thanks.. John

said by ZOverLord :

Thanks, it is the only sure way I know of to protect XP based systems even from Zero-Day exploits from persistent infection. This includes running as Admin using it.

said by controler :

Z?

I might have read this on MS help site but is a outside connection made everytime you start up disk protection GUI
to verify your Windows install is ligit?

controler

said by jt22 :

Is there any possble way I can so every account has its own set of start menu programs?

Thank you

said by controler :

Sorry Z I ment in early Beta they did not have the user Hive thing. I ended up installing it after.

I think the main point here is that MS provided this and it is part of the OS, unlike other software.

said by "ZOverlord" :

What I am saying is that if WDP failed during a user session, you would have many many errors in your event logs from programs that were running screaming about things that suddenly went POOF when the un-partitioned file area was no longer available. Imagine any program what was doing disk writes and reads of data to ("What it thinks is the Windows Partition") to the un-partitioned disk area, suddenly WDP is gone, the service to access this disk area is gone, anything that had been sent to it is not there, things like that would have caused many errors in the event log, which were not there. So WDP did not fail.

--- snip reiteration of ZOverlord's argument against Vampirefo's concerns ---

said by controler :

Event logs are never saved while disk protection is on.

said by BandHeight :

Hello, ZOverlord.

I've been following this thread for a while and doing some additional reading, but I have not actually installed SCT for various reasons (none related to any pre-conceived bias against the product ... mostly it's about lack of quality time to do it).

However, it seems to me in your zeal to toss water on the fire (not to be confused with "flame" :) ) that Vampirefo attempted to start, you may have sparked a little bit of a blaze yourself:

said by "ZOverlord" :

---

Lets pretend however, that it went off ("In the Middle of a user session"). Anything NOT in your paging file would be over in the un-partitioned disk area, meaning that your entire user session information, would be lost, which would cause the system to be instantly non-functional.

The WDP is provided via a system service and if it failed in some way the results of that would have created many many log entries by other running programs at the time that suddenly lost their linkage to the un-partitioned disk area.

The mess created by all of this, would have left the windows partition in such a state that it would be unlikely you could re-boot and function normally.

---

Is that really the expected result of a service failure or a power-outage or any unexpected system shutdown while SCT is running? If your answer is, "No", how have you tested these scenarios to see how resilient systems with SCT installed are to such events?

I used GoBack years ago for quite a period of time, and despite lots of reported issues by other people, I never had any problems at all, and certainly, GoBack never caused any additional data corruption if it was running during a power outage or crash (I had GoBack installed on a Win 98 PC, so crashes and lock-ups were not as uncommon as with Win XP Pro).

Thanks for any clarifying comments.

said by Vampirefo :

You are wrong I am not saying it's ok for Windows Shared Computer ToolKit XP to disable itself, this is a flaw, horrible design, it's so bad it should be removed from use immediately, If an IT worked for me and installed this on a company machine, I would fire him right now.

said by Vampirefo :

You simply don't understand, So let me try again, I downloaded a program installed it, went to bed got up to got to work program was still on my pc.

It should not be there if Windows Shared Computer ToolKit XP was doing it's job, I can reboot right now and the program will still be on my pc, cause it was disabled during windows update, not by me by itself.

This has now happened on three different machine so the fact is when 3:00 am rolls around Windows Shared Computer ToolKit XP disables itself when ever it's rebooted any program installed remains installed.

You say not a problem, LOL big problem this program is junk, until it's fixed no one should use this crapware.

said by JRosenfeld :

Many thanks, you've cleared up a lot of points. I might give it a try now.

I assume that if I subsequently decide to uninstall, I will be able to delete the image partition and recover the unallocated part of the drive?

said by controler :

very nice thread indeed. I tried starting one on Wilders but with no avale. I have been using this for along time now and love it. One thing not mentioned is you can install it with Windows already installed using Terabytes software to unallocate space. The other is the unloading of users. For this you install the user profile hive clean up tool
»www.microsoft.com/downloads/deta···ylang=en

said by Tuulilapsi :

As said, it's a good tool, and with the right restrictions it'll go a long way to prevent malware from even launching. My previous post was just something to keep in mind when using tools like this.

said by izvey :

As Tuulilapsi said, the personal data is vulnerable, but perhaps if you just put all the personal data, (like passwords) on a thumb drive and only plug it in after a reboot, might that work?

said by SpannerITWks :

I wonder how people with kids/teenagers etc do or will manage to live with it on a daily etc basis ?

said by SpannerITWks :

I wonder how people with kids/teenagers etc do or will manage to live with it on a daily etc basis ?

A large amount of them from what i see and have seen, want to DL and install and save all sorts of stuff. Most of them won't easily take no for an answer, or put up with any inconvenience that will hamper their time on the PC.

said by Tuulilapsi :

This is a good thread about a very useful tool, but there's one point I'd like to make, even though it is certainly glaringly obvious.

This is not entirely true. It's true that you can restore the system to its clean state, and I understand that's what you meant, but it's important to remember that it's not entirely safe to get infected and just restore to a clean state. No, during the time you were infected, before you returned to the clean state, any possible malware might steal any possible important information you may have on your system, such as credit card numbers, various passwords and such. Even when you wipe out the infection and restore a clean system, this information, if it has been compromised, will remain so. That's exactly why prevention is better than a quick restoration plan.

said by ZOverLord :

So, you can do anything as Admin and have peace of mind that no matter what malware you encounter or accidental changes or deletions are done, you will be as you were before whatever happened happened.

said by ZOverLord :

Yes this is the most rock-solid security Layer I have seen yet.

said by norwegian :

Well explained, it does seem there is enough to play with, to not require a seperate OS on the HDD.

I realise a lot may laugh at what i suggested, but to fully understand something with a tool, you need to ask these questions, and as you explain ZOverlord, it is capable of adjusting to suit the users needs, via the options, but yet still retaining a layer between your days usage, and the MAIN image, just incase.

This i like, may be an overkill, but if this was more the function of Microsoft's system restore, we may have all helped ourselves with infections and online browsing in a more active enviroment, but i guess that's why TeMerc was asking about VMWare and is it a security layer as was suggested in his thread

Great topic

said by JollyStomper :

Question:

From what I've read about this tool so far, this sounds like Deep Freeze except it's free. Would that be accurate?

Mind you, I haven't much experience with Deep Freeze, but have seen it in action. This tool sounds similar.

Thanks for all the info on this. Would be something to consider...

said by dannyboy 950 :

I ran across that last week, I thought I had posted and asked about it. Glad to know it works so well.
As soon as I get this thing cleaned up I will install it.
Will be checking with you for advice later.

** Below creates a template from testing user ID Public
 
Restrict.wsf /User:Public /Create /XML:Accounting.xml
 
** Below Applies the created template created from the
** Public test ID now contained in the Accounting.xml
** file to users in accounting and the Public ID can be
** used and changed to create other templates after being
** Changed with setting that apply.
 
Restrict.wsf /User:"John Doe" /Apply /XML:Accounting.xml /Lock
Restrict.wsf /User:"Bill Smith" /Apply /XML:Accounting.xml /Lock

said by norwegian :

Thanks for some great research here ZOverlord, one thing to have heard about a tool, but with the work you have done here, it is a topic worth bookmarking. Definitely worth trying out that's for sure.

The only thing that concerns me, is when trying out lots of software, and allow all till boot, it becomes an open door, which like any tool can become a weekness, as the user allows, or clicks allow, for something that may or may not be legit, or allow a script in that shouldn't.

In saying that, has anyone dual booted 2 copies of say XP Home, so one can be secure for needs such as banking, and more serious needs, by maintaining a very clean full install, before getting online ?? while still maintaining an area for trials and research, and i realise i am asking a great deal here, but surely it is worth discussing

As a setup machine lock down though once you are set up, it does sound very good

said by catseyenu :

Rats, not supported for Server '03.

said by fegul :

Oh well, I'm not even going to mess with it. I'll install it in Vmware and play with it there. Thanks for the help though :)

said by fegul :

So I need to make my primary partition smaller to use this or are you talking about free space on the drive? If thats the case then I dont want to use this. But I doubt MS would require you to mess with partitions if this program is meant to make things simpler

said by fegul :

I only have one partition on the drive, so the space after NTFS formatting is 114 GB. Of course, I have used some of that so I have 50 GB left

All my drives are formatted with NTFS

said by ZOverLord :

If for example Windows was on a 50GB partition, since the rule is 10 Percent of the drive or partition space or 1GB whichever is greater it would be 5GB.

said by fegul :

Only one partition (Primary partition). No part of the toolkit installed before since I got the same issue before. I did save the file to a folder on my desktop where I keep all of my Installers.

said by fegul :

Not a Dynamic disk, it has 50 GB free, and heres a screenshot. It happens almost immediately after I run the installer

said by fegul :

"Invalid drive C:\"

said by fegul :

It wouldnt install on my computer because my drive on which the OS runs on is not C: :huh:

said by tempnexus :

How many resources does it take?
Will it slowdown your windows experience?
Is it transparent to the user?
Is it transparent to the resources/performance?
I mean there is a fine line between security and turning your newest greatest 398349393Ghz system in a 486SX25Mhz.

said by TeMerc :

Based on your experience are there any other things users should do prior to installing? Any disc cleaning, defraging so forth to make install any easier or of that nature?

This seems to be a far better solution than what Mike was suggesting by far. This is going to be a good thread to keep an eye on for sure.

I've linked to it from my place as well as provided the newsgroup link as well:
»www.microsoft.com/communities/ne···edaccess

Thanks for the info.

said by astirusty :

This sounds a little crazy...
Say you have 120GB disk, with a 50GB windows partition.
From the quote the utility requires 12GB of unallocated space. It should be 5GBs at most.
Why does the utility need to monitor the other 70GBs of disk space?

said by ZOverLord :

The core of this tool is the windows disk protection which requires 1 Gig ("Or 10 percent of actual disk or partition size, whichever is greater") of use in unallocated disk space,