Securing Your System

Under Windows 2000, NT, and XP, any user with administrator rights can stop any program or service running on your system. If a user has these rights, there is no way to limit what that user can do. This document describes the steps you must take to secure your system. These steps are: Remove Administrator rights from your children Password Protect your Accounts Protect your BIOS The steps for Windows 95, 98 and ME are: Protect your BIOS Remove the ability to boot into Safe Mode We recommend you print this page out, because some of the steps listed below will require you to reboot your PC.

Common Questions Product Tour Registered Users

Remove Administrator rights from your children

As stated above, any administrator on the system has absolute privileges on the system. This section describes how to remove this privilege, and the problems this may cause.

1. Start the Control Panel and open User Accounts, or hold down Windows Key on your keyboard and press R to start the Run Program dialog, and type in control userpasswords
   
   
2. Click on each user that is shown as Administrator that you want to remove the privilege from, and do the following
   
   
   1. Click Change the Account Type
      
      
   2. Then click Limited
      

Limited users are not allowed to do many things on the system, including installing software. This has advantages for your systems security as well. For instance, viruses will not have full access to your system if run from these accounts, so may do less damage if run by your children. In addition, they should not be able to install plug-ins from the internet either.

The downside of this is that some programs will not have been written correctly for a limited user environment. If this is the case, changing permissions in the registery or file system will often allow you to use the programs. Please contact the company you purchased the program from for information on any compatibility issues you encounter.

Password Protect your Accounts

If your system has accounts with no password, anyone can walk up to your PC, and look around. This includes babysitters, or workmen. In theory, it could also present a security risk over the internet as well.

To make matters worse, on XP home, the system adds an Administrator account when XP is first installed. If you purchased your PC with XP already installed, the liklihood is that there is no password on this default account.

If this account is left unprotected, anyone can gain access to your system, and change passwords and remove accounts. The steps to password protect the Default Administrator are:

1. Boot Windows into Safe Mode by pressing F8 over and over again when Windows is first starting. This is a tricky operation, and you may need to restart again if you do it too late. Once you succeed you will be presented with a menu asking how to start the system. Choose Safe Mode.
   
   
2. Once in safe mode, click on the Administrator account. Odds are that you won't be asked for a password. Think up one you will never forget, because you may need this one if anything ever goes wrong with your system.
   
   
3. Go to the control panel, and choose User Accounts, then select the Administrator account.
   
   
4. Select Change the Password, and set up your password.
   
   

Now no-one will be able to get access to an administrator account through safe mode.

Protect your BIOS

Believe it or not, if you have not set up a password on your BIOS, anyone with physical access to your system, can boot up from a floppy disk or CD-ROM, and then make changes to your system. In order to prevent unauthorized access to your system, we recommend you do the following.

1. Set a BIOS setup password.
   When you first boot your PC, you will need to press a key to enter the BIOS setup. Usually, this will be one of the following keys: F1, F2, F10, F12 or Delete. On many PCs you must press this when you first see your manufacturer's logo. Consult your PCs manual for full details.
   
   After you enter the BIOS setup, you should see an option for passwords.
   • System Password:
     
     If you set this password, you must type it in before anyone can access your system. If you have small children you will probably not want to set this password, so that they can always restart the computer. However, setting this password does add some extra security in case of theft of your PC.
   • Setup Password:
     
     You definitely want to set a password for setup. By doing this, no-one can make changes to the way your PC boots up without knowing this password. In addition, your children will not be able to accidentally make changes to the PC which may stop it booting up. You will only be asked for this password when entering the BIOS setup.
   
   
2. Set the boot devices on your system.
   
   In an ideal world, you want your system to only boot from the hard disk. Unfortunately, many BIOS systems don't allow this, and you can only choose the order. If this is the case, select the Hard Disk to be the first option. Unless your hard disk fails, there will be no way to boot from any other device without entering the BIOS setup, having entered the password you set up above.
   
   Setting up the system to boot in this way also prevents any risk of getting a virus from any floppy disk left in the drive. It may also make your PC boot faster.

The next section only applies to:
Windows 98, 95, and ME

Remove the ability to boot into Safe Mode

On these systems, it is possible to prevent booting into safe mode. If you cannot do this, you cannot get around Quality Time. Please make sure that you have a boot disk for your system if you choose to do this. Here's how:

1. Create a Boot disk
   
   Do this by going to the Control Panel and choose Add/Remove Programs. Then click on the Startup Disk tab. Finally, click Create Disk.
   
   You will need a floppy disk for this, and you should keep it in a safe place. In the event that you ever need to get control of your system, you will need to enter BIOS setup, (described above), and allow your system to boot from the floppy disk. Then insert this disk, and you can proceed.
   
   
2. Remove Safe Mode from the boot options After completing the above steps, do the following:
   
   
   1. Open the file C:\MSDOS.SYS by holding down the Windows Key on your keypad and pressing R to start the Run Program command, and type in
      command to start a command prompt.
      
      
   2. Make the file c:\msdos.sys writable by typing:
      attrib -r -h -s c:\msdos.sys This makes the file writable, not hidden, and not a system file.
      
      
   3. Edit the file by typing:
      Notepad c:\msdos.sys
      
      
   4. Remove the ability to boot into safe mode by adding the following lines under the [OPTIONS] section:
      BootSafe=0
      BootKeys=0
      
      
   5. Save the file.
      
      
   6. Set the file attributes back by typing the following in the command prompt:
      attrib +r +h +s c:\msdos.sys
      
      
   7. type exit to leave the command prompt.
      
      

Your PC will no longer boot into safe mode from the hard disk, and Quality Time (from version 3.65) will lock the file MSDOS.SYS file when it is running so that it cannot be modified.