Tweaking Optimizing Windows.pdf - GEGeek

11. Remove the default administrators group.
12. Add the account used for auditing.
13. Click ok.
22. Group Policy Editor
On 2000 and XP you can use the group policy tool to restrict access. If you would like to limit or control just about every aspect of
your computer you can use a great tool called the group policy editor. Click Start and select Run. Type gpedit.msc in the text box
and click on OK. The group policy editor will load. Navigate through the folders and you will discover hundreds of items that you
can limit access to and control.
23. Security Templates
This applies to 2000 and XP. During installation, a set of standard security settings is applied to the system: these settings are
known as a security template. To get a detailed analysis of the security settings on your machine, open the MMC and select
Add/Remove Snap In from the Console Menu. Click on the Add button, and select the Security Configuration and Analysis, and
Security Templates snap-ins.
If you view the Security Templates option, you will see a list of the basic security templates that are available to your system. You
can view the security settings that each individual template applies by clicking on the plus sign next to each template. The basicwk
template is the default workstation security template, the hisecws template provides higher security workstation settings while the
compatws template provides maximum compatibility for non-Windows 2000 certified applications.
The template named Setup Security is the default setup template, by double-clicking on this you can see a list of the security
settings that this template applies under each section of the system, i.e. Account Policies, Local Policies, Event Log, Restricted
Groups, System Services, Registry and File System. Double clicking on each individual item will give you more detailed information
on that particular setting. For example under the default Setup Security template, if you look under Account Policies, then Password
Policy you will see the security setting for the system passwords.
To view the settings that are currently applied to your machine, right click on Security Configuration and Analysis and select Analyse
Computer Now. To apply a different template, right-click on Security Configuration and Analysis and select Import Template. You
can then choose from the selection of standard templates. You can also modify an existing template to your chosen settings, then
choose Export Template and save it as a new template.
24. Disable or delete Unnecessary Accounts
You should review the list of active accounts (for both users and applications) on the system in the Computer Management snap-in,
and disable any non-active accounts, and delete accounts which are no longer required.
25. Set account lockout policy
Windows 2000 and XP includes an account lockout feature that will disable an account after an administrator-specified number of
logon failures. For maximum security, enable lockout after 3 to 5 failed attempts, reset the count after not less than 30 minutes,
and set the lockout duration to Forever (until admin unlocks).
The Windows NT Resource Kit includes a tool that allows you to adjust some account properties that aren't accessible through the
normal management tools. This tool, passprop.exe, allows you to lock out the administrator account: The /adminlockout switch
allows the administrator account to be locked out
26. Require CTRL-ALT-DEL before login
In 2000 and XP under Control Panel/Users & Passwords ensure that the "Users must enter a user name and password" box is
checked, and under the Advanced tab, that "Require users to press CTR-ALT-DEL before logging on" is checked.
27. Don't Display Last User Name at logon
Either use TweakUI and clear the checkmark next to Clear Last User at logon in the Paranoia tab or utilise a registry entry. Enabling
this will blank the username box on the logon screen. Preventing people that are logging on from knowing the last user on the
system and also from preventing account lockouts for the wrong person.
Win9x Settings
Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon]
Value Name: DontDisplayLastUserName
Data Type: REG_SZ
Data: (1=enable, 0=disable)
NT Settings
Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Value Name: DontDisplayLastUserName
Data Type: REG_SZ
Data: (1=enable, 0=disable)
If that doesn't fix it, follow this solution (make sure you have a note of all your ISP usernames and passwords)
First, delete your .PWL file from the C:\WINDOWS folder.
Next, delete the equivalent entry from C:\WINDOWS\SYSTEM.INI's [Password Lists] section.
Next, open Control Panel > Network and ensure Windows Logon is installed and that it is the Primary Network.
Reboot. When asked for a username and password, enter your usual username and hit Return. Do NOT enter a password- leave it
blank. Hit Return to confirm the blank password. That's the last time you'll be asked to logon to Windows. When you logon to your
ISP, you'll have to enter your username and password, but once connection is established, these will be remembered for future
logons, provided you checkmark the appropriate box, of course.
If you're on a LAN, use Client for Microsoft Networks, instead. You will need to use Tweak UI's Logon instead.
If you WANT to logon, but can't, remove the following registry value: