Windows 95 Security: The Issues

Before you integrate Windows 95 security into your network security model, you should consider the following issues:

• What kind of logon security do you need? Do you want to require that users log on to Windows 95 and the network with the same password? Do you want to require alphanumeric or minimum-length passwords for the Windows 95 logon password? Do you want to require that users be validated by the network security provider before being able to log on to Windows 95?

  For both Windows NT and NetWare networks, you can use system policies to require validation by a Windows NT or NetWare server before allowing access to Windows 95 and to specify other Windows 95 password restrictions.

• What kind of resource protection do you need on Microsoft networks? If you allow users to enable peer resource sharing, then you must decide whether users can protect those resources with share-level or user-level security. User-level security provides greater security because the network security provider must authenticate the user name and password before access to the resource is granted. (Share-level security is not available for File and Printer Sharing for NetWare Networks.)
• What kinds of access rights will users have to resources protected by user-level security? You can specify the types of rights users or groups of users have to resources by setting Access Control properties in the Network option in Control Panel. For example, you can restrict other users to read-only access to files or give them read and write access to files.
• How do you want to enable user-level security? You can enable security in a setup script, in the Network option in Control Panel, or in system policies. If you enable user-level security in either a setup script or in the Control Panel, then Remote Administration is enabled by default for domain administrators on a Windows NT network and for supervisors on a NetWare network.
• Do you want to disable password caching for password-protected resources? You can use system policies to disable password caching and require users to type a password each time they access a password-protected resource.
• Do you want users to be able to configure system components, their desktops, applications, or network connections in Control Panel? You can use system policies to restrict users' ability to configure components.
• Do you need to control access to a computer's hard disk drive? Because Windows 95 uses network-based security instead of workstation security, an individual computer running Windows 95 is vulnerable to someone accessing data stored on the hard disk by starting the computer using Safe Mode or a floppy disk. If specific data requires greater levels of security, you should store critical files on a secure server. If computers require greater levels of security, Windows NT Workstation is recommended because it provides a means to protect resources on a hard disk based on a user's identity.
• Do you need to prevent users from modifying computer settings or from running certain applications? To implement this type of security, you should use system policies as described in Chapter 15, "User Profiles and System Policies."