PC Lockdown

I have a cousin which will be coming to my house soon.
He's kinda geeky and i'm pretty sure he WILL MESS UP MY COMPUTER when i'm working because my PC is the only desktop in the whole house.

So, right now i'm planning to create an user for him and lock it down COMPLETELY.
So i need ideas and probably tutorials.
I want the user to be locked down like in companies computer where you cannot do a single thing unless you have access to admin rights (Which i will have)

I need ideas.
Currently what comes to my mind is LUA + SRP + EMET and Avast! probably.
Any other ideas?

 

or just Defensewall or even OA pasword protected so no instalations are allow
for OA when the gui is lockdown it will denny any instalations in your system unless is trusted but if you want you can also configure for trusted vendors to be block if you want to

 

These are good suggestions. Also Returnil. With virtual mode enabled he can do whatever he wants and after a reboot all will be like it was before he came.

 

Ice the puck with Deep Freeze.

 

Yes. That's probably the most easy way to do it actually. But if you don't like Returnil then you can of course use a similar app.

 

It depends on just how geeky he is. Does he know how to bypass windows passwords? If so not much you can do besides FDE and forcing him to use a live CD. If he isn't that geeky or a hacker like me than all you need is LAU + SRP +EMET as you said or force him to use a live CD and BIOS lock him from booting the HDD.

 

Actually, you shouldn't give him live cd rights, because that's how passwords are usually changed. Not to mention other possible destruction of the hard drive without restrictions.

 

My suggestion would be to take your hard drives with you to work or leave it in the trunk of your car and let him run a LINUX distro live CD off of RAM. No password is safe when he is physically there... there are many software out there that can bypass windows without you knowing it. Good luck!

 

Follow the wiseman and you shall overcome everything my good friend

 

or Returnil

 

indeed

 

I would probably not let him at the computer at all, that seems to be the best solution!

Some kind of virtualization seems to be the way to go for you, I think I'd say Returnil too.

 

- Sandboxie
[+]
- One (1) of the following: Returnil, Shadow Defender, Deep Freeze.

 

+1
DeepFreeze or any other similar software like ShadowProtect or Shadow Defender, it's all you need.

 

Heres useful feature of Returnil: Virtual Mode Always On
You can lock the interface with password too
(Hope you can see the pic).

 

Keriver 1 Click Restore Free. Make a baseline image after he leaves Restore to the baseline.

 

Hahaha thanks for suggestions.
I knew someone would mention Deep Freeze They had those on my school computers . . . What a PAIN!
I don't think he knows how to reset passwords so that's pretty much all i'll need to do. (Aside from denying all rights to all folders except a few ones)

 

Does this mean you want to block Windows updates and other trusted software updates? (they may be critical security updates, BTW).

 

Except if he´s running an admin account and he has the bad luck of getting infected with TDSS, then Deep Freeze will not protect you.

 

Hahaha i may have sounded a bit too much with "lockdown" but anyways that's what i basically wanted to do.

I already have the ideas in mind. Thanks d00ds for recommendations!

 

Take out the HDD, power cable, keyboard and mouse

 

Set a password to access BIOS. In BIOS, disable booting from removable media (floppy/optical/usb).

Choose your flavor of protection then with either the deepfreeze/shadow method or simply a restricted account. Either you reboot to a clean slate or you simply don't let him make changes.

Sul.

 

copy my setup and follow Sully's suggestion above this post.