Windows System Control Center is a frontend for Nirsoft and Sysinternals software programs. The portable software displays the options at first start which is important to make sure the path to Sysinternals and Nirsoft applications is set correctly. Only one directory can be selected that has to contain all applications. This is not such a big problem for Sysinternals because the Sysinternals Live address is given as a backup for that. Most, if not all, of the Nirsoft and Sysinternals applications are portable which means it should not be a problem to move them into one single directory though.

The Control Center will display the applications sorted by publisher and categories but it is also possible to display all applications in one huge list. A click on a category will load the application list which contains a short description of each application listed in that category, a button to launch it and a icon at the beginning that gives information if the application is installed or can be started online.

The application provides access to two additional categories: Windows Utilities and Administrative Tools. Windows Utilities contains links to the Character Map, Disk Cleanup, Disk Defragmenter and Security Center while Administrative Tools lead to Computer Management, Data Sources, Event Viewer, Local Security Policy, Performance and Services.

The tool uses roughly 3 Megabytes of computer memory while running. It’s portability make it an ideal candidate to use on an USB stick together with Nirsoft and Sysinternals applications.

Each client creates a unique ID and password and the user who wants to give access to his computer has to send that data to the other user who enters it in his computer. The presentation mode for example displays the full computer screen of the client’s computer giving the other user the option to follow each and every action of the client in real time. There is virtually no delay and the quality of the picture is really good. Even small fonts are readable.

The other options, remote support, file transfers and virtual private networks work the same way. Everything is streamlined for ease of use. Transfers and connections work behind firewalls as well which works nicely in combination with the portable version of Teamviewer.

Teamviewer is free for commercial usage. A few additional versions are available at the developers homepage that suite specific needs. A support version is available for customers which is a basic version of Teamviewer that can only be used to connect to the client’s computer.

You also find a server version and a manager version at the download page. This is an excellent solution for anyone who has to remotely connect to clients computers regularly, who wants to do presentations over the Internet or use a virtual private network. It is free only for non-commercial usage.

The Yahoo Server Monitor Widget is a nice to have widget that is displaying several information about a server on the user’s desktop. It is by far not a complete solution but it works quite nicely for the time the user is working on the PC.

The Server Monitor Widget displays information like CPU Load, Server Uptime, Hard Disk Space, Server Address and Cache which is nice for a quick overview. It pulls the data from the free phpSysInfo script that has to be installed on the server.

This script does not check specific services like MySQL and Email but it gives information if a server is up or down.

The software can scan remote drives for deleted files, preview those deleted files and eventually recover them. There is obviously the need for a direct connection between the client’s computer and the admin which is utilized by a TCP/IP network connection. A software is running on the client computer that initiates the connection to the admin computer. That connection can be initiated manually or automatically.

Once the connection is established the administrator can use a graphical user interface to scan the local hard drives. A filter can be configured to find only files that match the pattern.

The remote hard drive is then scanned for deleted files. Everything that gets found will be listed in an Explorer like window. The directory structure is shown in the left pane while the right pane contains the files that have been found.

Information about the files are shown as well, most notable the size of the file and an estimation about the chance of recovering the file. Another handy feature is the Wipe button that seems to remove the deleted files permanently from the hard drive. I was not able to find out which algorithm, if any, is used to do that though.

An owner of a computer surely wants to install software on it even if he is running as a limited user. This is where the problem starts. The Run As command can be used to run applications as a different user. The major problem is that you have to provide the username and password for that user to be able to run the selected application. This data can be easily logged by a keylogger.

Surun uses its own Windows service that adds the user to the group of administrators during program start and removes him automatically from that group again. The user, not the administrator, will be asked on a secure desktop that only services may access if he wants to run the program and if he confirms that the application will be started. Programs are started with a right-click and the selection of Run as Administrator.

Surun comes with lots of settings and a huge configuration. Each application that was once started with Surun can be added to a list of applications that are started without the prompt from then on.

All you need to do to find out the amount of existing user accounts is to open the command line in Windows and type the following command netsh dump > netsh.txt. Open that text document in a text editor and scroll down to the section entitled ‘Ras Configuration’.

You will most likely find the following user accounts listed there:

set user name = Administrator dialin = policy cbpolicy = none
set user name = Guest dialin = policy cbpolicy = none
set user name = HelpAssistant dialin = policy cbpolicy = none
set user name = SUPPORT_388945a0 dialin = policy cbpolicy = none

Plus the real user account that you are using to login into Windows. The command net user 'username' reveals detailed information about that user account. Just replace ‘username’ with the name of the account that you want to get information for.

net user Administrator is a built-in account for administering the computer/domain
net user Guest a built-in account for guest access to the computer/domain
net user HelpAssistant is a Remote Desktop Help Assistant Account.
net user SUPPORT_388945a0 is a This is a vendor’s account for the Help and Support Service.

I do not need those accounts. Maybe the administrator account could come in handy if I can’t login into Windows anymore with my normal user account but all the other accounts are a security risk and not needed at all. I therefor made the decision to remove the HelpAssistant and Support_388945a0 account and password protect the Administrator and Guest account.

The reason why I keep the Administrator and Guest account is not a choice of mine. It is simply not possible to delete those accounts. The next best thing is to password protect them properly.

You delete a user account in Windows using the following command: net user 'username' /delete. This would mean that I would write net user Guest /delete to delete the guest account.

Changing the password is as easy. To do that use the command: net user 'username' 'password. If I wanted to change the password of the Administrators account to ghacks I would use the command net user Administrator ghacks

An easier method would be to run selected programs using a reduced privilege level to reduce the possibility that malicious software can infect the computer. The script that is able to do this is called Drop my Rights and was developed by Michael Howard for Microsoft.

The software is command line driven but you can easily create shortcuts to the programs that you want to run with reduced privileges. The most likely candidate for this is of course the web browser that you are using, especially the Internet Explorer.

To create a shortcut to a program on your computer do the following. Create a shortcut for the program and right-click it afterwards. Select Properties from the menu and click on the shortcut tab if it is not the active tab already. The target entry contains the link to the application that is started when you double-click the shortcut.

All that needs to be done is to add the link to the drop my rights executable before that initial entry and add the privilege level behind that entry. Let me explain it with an example:

“C:\dropmyrights.exe” “c:\something.exe” C

Privilege levels can be N for normal users, C for Constrained users and U for untrusted users. Please note that many programs do not work if you run them as an untrusted user and that some applications do not work for constrained users. Securityfocus conducted a series of tests to show the differences between constrained and normal users and I took the liberty to quote the important results.

Administrator:

During the testing a number of unrecognized applications were installed. Changes were made to the GUI of Internet Explorer including the addition of various buttons and search-bars. Phantom windows would appear and disappear at random, and there were numerous popups. The virtual machine itself was running noticeably slower as well. Although an online virus scan was initiated, it didn’t complete successfully. In fact the scan died with an error before it actually completed. It found 7 infections, however, before it finally died.

Normal User:

The only observation of note during the experiment is that pop-ups still occurred. There were no phantom windows or unexplained applications installed. However the virus scan still turned up 4 viruses. Since the author recommends the “C” parameter while surfing more questionable sites, the next portion of the experiment did exactly that.

Constrained User:

During this final experiment the only oddity observed was that the Internet Explorer window would maximize if it wasn’t already. There were no pop-ups, pop-unders, or any of the other effects previously observed, and this time the virus scan turned up zero viruses.

All tests were performed using the Internet Explorer to visit unfriendly sites. It should be noted that this does not mean that you are 100% secure if you run your programs with constrained users privileges but it adds to the security and this is what really counts.