RonTheCon

Solve Security Issues in Windows XP by Ron Mods: Please sticky this and change description to: Manual tweaks you can do to improve Windows XP Security. My description got cut off and I can't edit the title nor the description for this thread. Thank you. Do you not believe me? Think I'm some crazy hacker? Think I'm weird? Well ok then lol. All these tweaks are from websites such as www.TweakXP.com, www.TweakHound.com, www.WinGuides.com/windowsxp/, and www.MarkusJansson.net/exp.html so I'm not just pulling these tweaks right out of my bum. All I have done is organized it, and put all the most efficient and compatable tweaks that will still keep your operating system very stable with very few problems. At the end of this tutorial you can scan your computer for open holes and such and I guarantee you that you will have about 20 or so holes fixed on XP. This tutorial is practically a nessecity if you don't have a firewallsuch as McAfee, Norton, or Zone Alarm. WARNING: Please Create a system restore before even thinking about doing this tutorial. To run a system restore click on Start > Program > Accessories > System Tools > System Restore > Create a Restore Point. Sorry for all the people that have XP Home and not the Pro version. Turns out if you give Microsoft more money they will include more security features in the Microsoft OS, but won't turn them on because they are a**holes. Anyways, all the Categories for each listing says if it's for XP Pro Only or XP Home/Pro which means for both. Now here's the tutorial. -> First Step is to Backup Registry - XP Home/Pro - Thank you Andavari Download ERUNT. This is freeware by the way. and look for Back Up registry or something. -> Network Connection Security - XP Home/Pro Go to Start > Settings > Control Panel > Network Connections > Right click on Local Area Connection 2 > Click on Properties. On the General Tab, uncheck every checkbox except for Internet Protocol (TCP/IP). Now click on Internet Protocol (TCP/IP) and click on Properties. On the General tab, click on Advanced at the bottom. Advanced TCP/IP Settings should pop up. Click on the Options tab, then click on TCP/IP Filtering and click on Properties. Uncheck Enable TCP/IP Filtering (All Adapters). -> Closing ICMP Protocol and a few others - XP Home/Pro Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > Tcpip > Click on Parameters, but do not click on the +. Double click on EnableICMPRedirect, which is on the right hand pane when you have clicked on Parameters. Once you double click on EnableICMPRedirect, change its value to 0. Make sure to also change the values of EnableDeadGWDetect, EnablePMTUDiscovery, and PerformRouterDiscovery to 0. While you're in Parameters, make sure to change the values of EnableDeadGWDetect, EnableSecurityFilters, and NoNameReleaseOnDemand to 1. -> Closing DCOM Protocol - XP Home/Pro Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > Software > Microsoft > Ole Double click on EnableDCOM and set it to N. If the key doesn't exist, then create it by right clicking and clicking on New > String Value. Click on the new one you just made and press F2 to rename it to EnableDCOM. Go to HKEY_LOCAL_MACHINE > Software > Microsoft > Rpc Double click on DCOM Protocols and remove ncacn_ip_tcp only! Go to HKEY_LOCAL_MACHINE > system > CurrentControlSet > Services > Dnscache > Parameters and double click on MaxCachedSockets and change its value to 0. If it doesn't exist, create one by right clicking and clicking on New > DWORD Value. Click on the new one you just made and press F2 to rename it to MaxCachedSockets. Go to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > NetBT > Parameters and click on SmbDeviceEnabled (REG_DWORD) and set its value to 0. If it doesn't exist, create one by right clicking and clicking on New > DWORD Value. Click on the new one you just made and press F2 to rename it to SmbDeviceEnabled. -> Tightening "Restrict Anonymous" Holes - XP Home/Pro Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Control > Click on Lsa, but do not click on the +. Double click on restrictanonymous and change it to 2. Double click on restrictanonymoussam and change it to 1. -> LanMan - XP Home/Pro Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > lanmanserver > Parameters. Double click on NullSessionPipes and erase everything in it. Double click on NullSessionShares and erase everything in it. Click on lanmanworkstation and do the same if there is NullSessionPipes and NullSessionShares. Make 2 new keys in lanmanserver (not lanmanworkstation) by right clicking on Parameters > New > DWORD Value > Change its name to AutoShareServer and make the other one AutoShareWks. Before setting their values, please read this. "This source claims, that it affects only Win2000, which has only 2 keys for it and WinXP has 3 keys for it. According to it, in WinXP it doesnot matter, if it is 1 or 2, but Belarc Advisor does not like it, when it is set to 2, so it lowers my score (from 7,29 to 6,46)." - TheTOM_SK So if you do not have Belarc Advisor, then set the value to 0. If you do, set the value to 2. -> User Accounts - XP Pro Only By default, the Guest account password is blank. Make it something difficult, such as a combination of letters and numbers, preferably not based on dictionary words. Go to Start > Settings > Control Panel > Administrative Tools > Computer Management > Local Users and Groups > Highlight User Account > right-click and click on Set Password. Remove/Delete any unused accounts, especially any 'remote assistance' accounts. Disable the Guest account since you can't delete it. Go to Start > Settings > Control Panel > Administrative Tools > Local Security Policy > Local Policies > Security Options Account > Rename Guest Account - Double click and rename the account to something weird like Fa98sasjd9as (this is where the weirdo leet language comes into play, but only here). -> Remote Machines - XP Pro Only If you do not need to connect to your computer from a remote machine, be sure to turn this off. Go to Control Panel > Administrative Tools > Local Security Policy > Local Policies > User rights Assessment > "Access this computer from the network" and then delete all users and groups. This should now be blank. Click on "Deny access to this computer from the network" - this should include all users and groups. Double click on the policy, click Add User or group, click Advanced, click Find Now, highlight all the accounts and click OK. Under System Properties > Remote > Turn off Remote Desktop and Remote invitations -> Change Remote Scheduled Tasks - XP Home/Pro Instead of having to wait for the remote scheduled tasks, which is useless information to anyone who is not a system administrator remotely configuring scheduled tasks, you can disable this feature. Go to Start > Run > regedit > HKEY_LOCAL_MACHINE > Software > Microsoft > Windows > CurrentVersion > Explorer > RemoteComputer > NameSpace In the NameSpace folder you will find two entries. One is "{2227A280-3AEA-1069-A2DE-08002B30309D}" which tells Explorer to show printers shared on the remote machine. The other, "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}", tells Explorer to show remote scheduled tasks. This is the one that you should delete. If you have no use for viewing remote shared printers and are really only interested in shared files, consider deleting the printers key, "{2227A280-3AEA-1069-A2DE-08002B30309D}", as well. This will also boost your browsing speed. -> Disable Posix and OS/2 - XP Home/Pro DO NOT USE REGEDIT! Go to Start > Run > regedt32 Find HKEY_local_machine\system\currentcontrolset\Control\Session Manager\SubSystems Click on SubSystems Folder, but don't click on the Plus button, just click on the folder. Double click on the multistring called Optional in the right-hand pane. By default, the multistring's value will be POSIX; Delete that value and leave the space empty, but don't delete the Optional multistring. -> Firefox, an alternative to Internet Explorer - XP Home/Pro This program is the best web browser on the internet and clears soooo many holes by using this browser instead. Plus it has many positives and few negatives, while Internet Explorer has many negatives and few positives. More info here on Mozilla Firefox vs. Internet Explorer. -> Disable Crappy Services we don't need - XP Home/Pro Open up services.msc by going to Start > Run > "services.msc" without the quotation marks. Disable the following services and click on the button Stop if they are running. Automatic Updates - Though, you still need to do windows updates, but you don't need a process running all the time, slowing down your computer. Just do it by hand by going here. Alerter Clipbook Computer Browser Error Reporting Service - If you want to report everyone of Microsoft's errors, don't turn this off. Have fun. FTP Publishing Help and Support - Put this on manual Human Interface Device Access - This is recommended for people with usb mouse or keyboard, without it, it wont work! Indexing Service Messenger NetMeeting Remote Desktop Sharing Network DDE Network DDE DSDM Performance Logs and Alerts Protected Storage - This saves passwords. You should never save passwords, but leave this on incase you still do. Evenif it does leave secuirty holes and your passwords up for grabs... Remote Desktop Help Session Manager Remote Registry Routing and Remote Access Secondary Logon Security Accounts Manager SSDP Discovery Service Telnet Universal Plug and Play Device Host -> Reboot your Computer - XP Home/Pro Check to see if your internet works. Check to see if you can have other programs connect to the internet. If you can't, then post in this topic for help. I'll be able to figure your problem and help you find a solution. -> Windows Updates - XP Home/Pro I can't stress this enough. You NEED to do windows updates. Microsoft sucks so much, but everytime they issue out a patch or whatever, download it immediately. Every now and then just check for Windows Updates by clicking here or going to your Start Menu and clicking on Windows Updates right above Programs. If there are any updates to install, download and install them, and then reboot your computer. -> Run Online Security Checks - XP Home/Pro - Use IE for this only. Sorry Firefox fans. Hacker Whacker's Sweet Security Scans GRC - Shields Up Emsisoft's Security Checks Sygate Tech's Security Checks TrendMicro's Online Virus Scan Hacker Watch's Test Your Firewall - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Aftermath: YAY! Your computer should be much faster, much safer, and just much much better! Tell all those pesky hackers to **** off! Great job, and I hope to add more security tweaks in this topic. The changelog for this tutorial is in the next post. Once again. Great job! Want to Tweak your computer even more? Click Here. ~Ron Credits Me lol. TheTOM_SK Andavari