XP Home vs. Pro - Security & Performance

An old debate for sure. I tried digging into the archives for some info. on this but most of it is dated, vague, and contradictory. I figured now, after years of end-user experience by many with both I could get some fresh ideas.

Most of my experience is with Home. I preferred it because it was lighter, and I didn't need all that extra networking stuff. A friend of mine is going to reformat his PC. He has both a Home & Pro disk available and wanted my opinion on what to use. He asked me some questions I couldn't answer, and knew this was the place to ask them. He's a single PC user (no network), and your typical home user (no bells & whistles required), so I was naturally inclined to recommend Home... but security is something that matters to him, which leads me to my questions:

One thing I hear as a pro for Pro over Home is "security". I saw it mentioned several places that it's "more secure", but nobody really elaborated much as to why. It sounds to me that there's a boat load of stuff in Pro enabled by default to make it easier for the end user to make remote connections, or vice versa (others remotely connect to you). I would think that would make this puppy less secure, not more... as security is being traded for potential convenience later on down the road.

So as I look more into the so-called "security benefits" of Pro I start seeing this "EFS" encryption mentioned. Okay... this sounds like something beneficial. But how useful would it be to somebody not on a network (single user)? Wouldn't it kind of render it moot, as at that point direct access (from your own chair) would be the only way to those files? And with somebody who hits Flag+L every time they turn their back on their computer the chances of that are nil.

And how would this EFS compare to just using a program like Axcrypt or Comodo Disk Encryption on Home... just in case he would like encryption as a feature?

I did experiment with Software Restriction back when I used Pro, but it's a bit fuzzy now. But said friend has fallen in love with Comodo Firewall/HIPS since I introduced it to him. Is there anything that SRP can do that his HIPS can't? If not it'd be useless to him. Anything other potential benefits in Local Policy I'm leaving out?

Any other added security benefits at all I'm leaving out for Pro over Home? Those are the only 2 I really saw (EFS and Local Policy).

Thanks a bunch for the help

 

I would go for XP Pro, definitely a good product. I had my old PC setup as power user, allowed users to burn cd's and ran internet facing aps as limited user. A simple and very strong setup.

 

On a desktop computer the Home edition has mainly two disadvantages compared to XP Pro if you're seriously interested in security:

1. It lacks the security tab on the properties page in the explorer. You can add it by installing Fajo XP. This makes it a lot easier to view and change permissions for files/folders.
2. It lacks SRP. However, you can add it by installing Sully's PGS. You said that you experimented with SRP. Have a look at this site and try to understand. Why you don't need a HIPS is discussed in this thread.

 

It blows my mind that XP home does not offer a way to change file permissions. Were they deliberately trying to discourage LUA?

Does Windows 7 do the same thing?

 

Already some helpful replies, thanks... that's why I came here.

That is a great point you brought up about the security tab. As I understand it that would make using a LUA much more manageable? I tried getting into the realm of LUA once on Home and just found that I could not do ANYTHING on that account. If I so much as looked at something I got a big ol' "access denied" message in my face. It was unusable to me.

So on Pro would you say it's comparable to using a program like Drop My Rights with Home?

Also I'm sure that with some hardening the need for a HIPS can pretty much be eliminated altogether... but he will not give us his HIPS, he's become accustomed to it (so have I). I will take a look at that reading material anyway. I like to expand my knowledge on these things.

Thanks again.

 

Nope, XP Pro with LUA is much better
Add the program SuRun, and you pretty much never need to use the admin account directly.

LUA is very powerful for userspace seperation for security. You already know about admin/LUA seperation; about how LUA processes cannot screw up the system files etc. LUAs can also be used for seperation amongst themselves. Ie, to protect really imp info like logging into banks etc, have a seperate LUA that ONLY accesses those bank sites; seperate from the LUA which does normal browsing. One LUA account cannot access another; creating a seperation for security. With fast user switching, the user can switch between the accounts with ease.

 

Well, there is an awkward way how to do it: by using the cacls command in the console.

Only Bill Gates could answer that. In any case, this is not the only obstacle that suggests such an assumption. (Although, to be fair: If all apps behaved as they should there would not be much need to change file/folder permissions. But this again is also Microsoft's fault - they didn't push the programmers enough.)

No idea - I don't use that.

 

You can get the same page with regedit.

 

Would you care to elaborate?

 

I'f I'm not mistaken, someone on Wilders posted the registry info for this. At the time it blew right over everyones head and no one tested, questioned or commented on it that I'm aware of. I also think it was in one of your tutorial posts

Haven't found the reference here on Wilders yet but did find this on the net
http://www.geekstogo.com/forum/topic/169268-how-to-show-the-security-tab-in-xp-home/

 

Ah - I think you mean this post referring to pcwXPProme. It also works with the Microsoft Security Configuration Tool although I haven't tried that.

Thanks!

 

I'm curious to know if the reg tweak really works for adding the security tab. I still can't find the ref here on Wilders. I searched your topic but came up short. I could have sworn it was in that topic that someone mentioned the reg tweak.

 

In Windows Xp start/run-type regedit. Select find on the edit menu, type what file you want to find click "find Next" when The entry appears click on the edit menu "Permissions" and you get:

 

I think Thomas is referring to Explorer/File Properties