Find out how to clear the Windows page file, prevent users from changing their passwords, and deny guest access to various system logs.

Keeping up to date on patches and security updates isn't always enough to make Windows as secure an environment as you'd like. Three steps you can take to make your desktops more secure are clearing the pagefile on shutdown, disabling guest access to event logs, and preventing users from changing their passwords until prompted.

Not every organisation will want to take these steps, but, depending on your situation and the type of business you do, these can be good security options.

Clearing the pagefile

When Windows writes memory data to the pagefile, it can contain sensitive information that you don't want to be accessible on the disk, including passwords.

If anyone in your organisation works with sensitive information, clearing the pagefile on that desktop is an important step to take to ensure that data isn't accessible to unauthorised users.

By modifying a registry setting, you can have Windows clear the pagefile on shutdown. This will wipe data written to disk and prevent sensitive files from being accessible. However, the system may take longer to shut down because the computer must write to each page in the pagefile to erase the data contained in it.

To clear the pagefile each time Windows is shut down, perform the following steps:

1. Run Regedit.
2. Locate the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management.
3. Set the value for ClearPageFileAtShutdown to 1.

If the value doesn't exist, add the following:

• Value Name: ClearPageFileAtShutdown
• Value Type: REG_DWORD
• Value: 1

You must restart the computer for the setting to take effect.

Because this may lengthen the shutdown time, you may want to give the setting a trial period to see how it works out. If shutdown takes an excessively long time, you may want to change the value for the setting back to 0. But if securing sensitive data is critical to your organization, slow shutdowns may be something you're willing to live with. For additional information, see Microsoft Knowledge Base article 182086.

Restricting event log access

The default access setting for Windows event logs allows guest and anonymous users to view them. This can make sensitive data openly accessible to users who should not be able to view it.

A simple tweak of the registry, however, can rectify the possible security opening. You can block guest and anonymous users from viewing event logs by performing the following steps:

1. Run Regedit.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog.
3. Select the Application folder under EventLog.
4. On the menu bar, choose Edit | New | DWORD Value.
5. Type RestrictGuestAccess and press [Enter].
6. Double-click the new RestrictGuestAccess entry.
7. In the Edit DWORD Value dialog box, type 1.
8. Repeat the previous steps to create the same DWORD entry in the Security and System subkey folders.

This will prevent unauthorised users from having access to sensitive information stored in event logs, information that might be used to gain access to other locations or files that should be secure.

Locking down password changes

This may not seem like a necessary security measure, but consider what could happen if a user's password were stolen or hacked. The unauthorised user could then immediately change the user's password and effectively lock that person out of the network.

By preventing such password changes, you can thwart hackers or others from hijacking user accounts and you can also cut down on the number of calls the help desk receives from users who have changed their passwords and forgotten the new one.

There are two different ways you can lock down users from changing their passwords unless prompted by Windows-individually via a registry setting or globally via a Group Policy setting.

Perform the following steps to require a system prompt for password changes for a group of users:

1. Start the Microsoft Management Console (MMC) by choosing Start | Run, typing mmc, and clicking OK.
2. On the File menu, choose Add/Remove Snap-in | Add | Active Directory Users and Computers | Add.
3. Click Close and then OK. The left pane will display the new snap-in.
4. Expand the snap-in, select the group to which the policy applies, right-click, and choose Properties.
5. On the Group Policy tab, select the Group Policy Object and click Edit. If no policies are listed, click New to create a new policy and then click Edit.
6. Expand the policy folder and then expand the subfolders down to System.
7. Select Logon/Logoff.
8. Right-click the Disable Change Password policy and then choose Properties.
9. On the Policy tab, select the Enabled option and then click OK.
10. Close the Group Policy window and then close the console.
11. At the command prompt, type the following: Secedit /refreshpolicy user_policy /enforce
12. Press [Enter].

To enforce the same password policy for individual users, perform the following procedures to configure the option in the registry:

1. Run the Registry Editor.
2. Navigate to the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies.
3. Click the System key. If the System key does not exist, create it by choosing Edit | New and then selecting Key. This will create a new folder called New Key #1. Rename the key to System.
4. Select the System and then choose Edit | New | DWORD Value.
5. Type DisableChangePassword.
6. Press [Enter].
7. Double-click the new key.
8. Change the value setting to 1.
9. Click OK.
10. Close Regedit.

    For additional details on setting this password policy, see Microsoft Knowledge Base article 309799.

    Securing data

    These tips are simple steps you can take to restrict access to sensitive data and better secure your network. They take little time and effort to implement and can protect your organization's data.

    TechRepublic is the online community and information resource for all IT professionals, from support staff to executives. We offer in-depth technical articles written for IT professionals by IT professionals. In addition to articles on everything from Windows to e-mail to fire walls, we offer IT industry analysis, downloads, management tips, discussion forums, and e-newsletters.
    
    ©2001 TechRepublic, Inc.

    
    

    Copyright © 2009 CBS Interactive, a CBS Company. All Rights Reserved.
    ZDNET is a registered service mark of CBS Interactive. ZDNET Logo is a service mark of CBS Interactive.