DOCSLIB.ORG

Do Windows Users Follow the Principle of Least Privilege? Investigating User Account Control Practices

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Do Windows Users Follow the Principle of Least Privilege? Investigating User Account Control Practices Do Windows Users Follow the Principle of Least Privilege? Investigating User Account Control Practices Sara Motiee, Kirstie Hawkey, Konstantin Beznosov Laboratory for Education and Research in Secure Systems Engineering Department of Electrical and Computer Engineering, University of British Columbia Vancouver, Canada {motiee,hawkey,beznosov}@ece.ubc.ca ABSTRACT subject in a system be granted the most restrictive set of The principle of least privilege requires that users and their privileges possible for performing the task at hand. One practical implementation of PLP in operating systems is a programs be granted the most restrictive set of privileges 1 possible to perform required tasks in order to limit the dam- \least-privilege user account" (LUA), which requires users ages caused by security incidents. Low-privileged user ac- to use accounts with as few privileges as possible for day-to- counts (LUA) and user account control (UAC) in Windows day work on PCs [17]. To implement this approach, oper- Vista and Windows 7 are two practical implementations of ating system designers have developed various types of user this principle. To be successful, however, users must apply accounts and advise end users to employ low-privilege ac- due diligence, use appropriate accounts, and respond cor- counts for their daily tasks [17]. By following this approach, rectly to UAC prompts. With a user study and contextual users will be better protected from malware, security at- interviews, we investigated the motives, understanding, be- tacks, accidental or intentional modifications to system con- haviour, and challenges users face when working with user figuration, and unauthorized access to confidential data. accounts and the UAC. Our results show that 69% of par- While low-privilege user accounts enhance security, they ticipants did not apply the UAC approach correctly. All 45 have not been widely adopted. Indeed, during a Microsoft participants used an administrator user account, and 91% Financial Analyst Meeting in 2005, it was estimated that were not aware of the benefits of low-privilege user accounts 85% of PC users performed their daily tasks using adminis- or the risks of high-privilege ones. Their knowledge and ex- trator accounts [11]. One reason for the lack of LUA popu- perience were limited to the restricted rights of low-privilege larity is that many simple tasks (e.g., changing the system accounts. Based on our findings, we offer recommendations time when traveling, installing an application) can only be to improve the UAC and LUA approaches. done from an account with administrative privileges (\ad- min account" for short) [23]. It appears that users often choose the convenience of working with administrative priv- Categories and Subject Descriptors ileges over the reduction in risks associated with security H.5.2 [Information Interfaces and Presentation]: User breaches. Even though there is anecdotal evidence suggest- Interfaces|Evaluation/Methodology; D.4.6 [Software]: Ac- ing that mainstream operating systems support users poorly cess Controls|Invasive Software in following the PLP, there has been no published empirical data that could inform researchers and practitioners on the General Terms actual use of LUA and related mechanisms by users. The overarching goal of our research is to investigate how Human Factors, Security well mainstream operating systems for personal computers support users in following the PLP, and what can be done Keywords to improve such support. Our particular objectives are to Usable security, least privilege principle, least privilege user determine (1) how well users are aided by the technology to account, user account control follow this principle, (2) what challenges they face, (3) what factors motivate their behaviour, and (4) what are the areas 1. INTRODUCTION of potential failure for current PLP mechanisms. For the initial study which we report in this paper, we nar- To limit damages from security breaches, the \principle rowed the scope of our research to Windows Vista and Win- of least privilege" [16], or PLP for short, requires that each dows 7. In addition to LUA, Windows Vista introduced user account control (UAC) [23], which was intended to make the use of LUAs more convenient and therefore reduce incen- tives for violating PLP. With UAC, all users, including local administrators, can work with non-administrative privileges Copyright is held by the author/owner. Permission to make digital or hard when such privileges are not necessary. A UAC prompt is copies of all or part of this work for personal or classroom use is granted raised when one of the user's processes requires adminis- without fee. Symposium on Usable Privacy and Security (SOUPS) 2010, July 14–16, 1 2010, Redmond, WA USA Since LUAs may not necessarily be least privileged, we refer . to them as \low-privilege user accounts". 1 trative privileges (e.g., when installing software or changing pose and benefits of both UAC and LUA to users through system settings). UAC was revised in Windows 7 to reduce the interface itself, rather than only through the technical the number of prompts by default and to allow users to cus- documentation from the OS vendor. Furthermore, either tomize which prompts they receive. If UAC is disabled,2 the users should be made aware of the the distinction between type of user account determines whether the PLP is followed UAC and other security-related mechanisms (e.g., personal (in case of a non-admin account) or not (in case of an admin firewall, anti-virus software), or UAC should be integrated account). However, if UAC is enabled on a user's system, with the other mechanisms. In addition to the admin ac- it is not critical what type of user account is in use; as long count created upon installation of the OS, users should be as the user responds to UAC prompts correctly, the PLP provided with an initial, default, low-privilege user account is followed. Given this interdependency between LUA and and be encouraged to use it for their daily work. How- UAC and the critical role of the two in the support for the ever, to ensure users continue following LUA, users must PLP, we studied the behaviour of users in employing LUA be able to conveniently apply modifications on their PCs as well as in responding to UAC prompts. from within that low-privilege account. Furthermore, UAC To this end, we conducted a laboratory study, followed by prompts should be raised consistently, in selective and lim- contextual interviews. We recruited 30 Windows Vista and ited situations so that users do not ignore them due to habit- 15 Windows 7 users in order to observe any changes in their uation. These prompts should communicate enough infor- behaviour according to the different UAC implementations mation about their purpose and functionality so that users on these Windows platforms. None of the demographics of can respond correctly. our WV and W7 participants were statistically significantly In the remainder of the paper, we first discuss related different, except for the years of experience with the oper- work and background information about the mechanisms of ating system. The participants had a wide range of educa- applying PLP in Windows Vista and 7. We then describe tional levels (from high school to Masters) and the 16 (out the methodology of our study and its results in Sections 3 of 45) non-student participants had a variety of occupations. and 4, respectively. Section 5 provides a discussion of our To maintain ecological validity, we asked all participants to results, as well as recommendations for applying PLP. We perform study tasks on their Windows laptops. discuss the limitations of our study and outline future work It was perhaps shocking, but not surprising, to find every in Section 6 and conclude the paper in Section 7. single participant performing day-to-day activities on own their laptop using an admin account. To better understand 2. BACKGROUND AND RELATED WORK the factors affecting the use of LUA approach, we asked The aim of our research is to investigate whether users the study participants to complete a user account creation follow the PLP and how well the technology supports them task, and we probed their knowledge about LUA. Although in following this principle. We first present related work on most created an appropriate low-privilege user account in applying this principle. We then provide background about the study task, participants were not motivated to employ the UAC approach of Windows Vista and 7. As the UAC a low-privilege account for their own daily computer usage. approach is based on raising warning messages, related work Furthermore, 91% of participants did not understand the on warning messages is also discussed briefly. security risks of high-privilege accounts or the benefits of low-privilege ones. In addition to a lack of awareness of 2.1 The principle of least privilege security risks, prior experience with the inconvenience of Different mechanisms have been implemented for apply- low-privilege user accounts in different contexts of prior dis- ing the PLP. One main category of mechanisms is the user couraged participants from using such accounts. account model offered by various operating systems. There To investigate the use of the UAC approach, we asked are various types of user accounts with different privileges. participants to complete a set of tasks that raised legitimate In Unix-style operating systems, the root account has full and fake UAC prompts to observe their response behaviour. privileges, while a non-root or basic account has limited priv- Our results show that at least 68% of participants did not ileges. It is considered bad practice to use the root account use UAC approach correctly. These were participants who for daily use, as simple typographical errors in commands either disabled UAC (20%) or consented3 to a fake random, can cause major damage to the system [12, 5].
Load more

Recommended publications
  • Security Assessment Security Policy Assessment
    Security Assessment Security Policy Assessment Prepared for: Jonathan Doe Prepared by: Austin Archer 3/23/2018 CONFIDENTIALITY NOTE: The information contained in this report is for the exclusive use of the client specified above and may contain confidential, privileged and non-disclosable information. If the recipient of this report is not the client or addressee, such recipient is strictly prohibited from reading, photocopying, distributing or otherwise using this report or its contents in any way. Scan Date: 4/1/2014 Security Policy Assessment SECURITY ASSESSMENT Table of Contents 1 - Summary 1.1 - Sampled Systems 2 - Local Security Settings (Sampled Systems) 2.1 - Account Policies 2.1.1 - Password Policy 2.1.2 - Account Lockout Policy 2.2 - Local Policies 2.2.1 - Audit Policy 2.2.2 - User Rights Assignment 2.2.3 - Security Options PROPRIETARY & CONFIDENTIAL Page 2 of 14 Security Policy Assessment SECURITY ASSESSMENT 1 - Summary 1.1 - Sampled Systems IP Addresses Computer Name Operating System 10.0.7.28 tandem Windows 7 Enterprise 172.20.1.3, 10.0.1.3 DC01 Windows Server 2012 Standard PROPRIETARY & CONFIDENTIAL Page 3 of 14 Security Policy Assessment SECURITY ASSESSMENT 2 - Local Security Settings (Sampled Systems) 2.1 - Account Policies 2.1.1 - Password Policy Policy Setting Computers Enforce password history 0 passwords remembered TANDEM 24 passwords remembered DC01 Maximum password age 42 days All Sampled Minimum password age 1 days All Sampled Minimum password length 7 characters All Sampled Password must meet complexity requirements
    [Show full text]
  • Run-Commands-Windows-10.Pdf
    Run Commands Windows 10 by Bettertechtips.com Command Action Command Action documents Open Documents Folder devicepairingwizard Device Pairing Wizard videos Open Videos Folder msdt Diagnostics Troubleshooting Wizard downloads Open Downloads Folder tabcal Digitizer Calibration Tool favorites Open Favorites Folder dxdiag DirectX Diagnostic Tool recent Open Recent Folder cleanmgr Disk Cleanup pictures Open Pictures Folder dfrgui Optimie Drive devicepairingwizard Add a new Device diskmgmt.msc Disk Management winver About Windows dialog dpiscaling Display Setting hdwwiz Add Hardware Wizard dccw Display Color Calibration netplwiz User Accounts verifier Driver Verifier Manager azman.msc Authorization Manager utilman Ease of Access Center sdclt Backup and Restore rekeywiz Encryption File System Wizard fsquirt fsquirt eventvwr.msc Event Viewer calc Calculator fxscover Fax Cover Page Editor certmgr.msc Certificates sigverif File Signature Verification systempropertiesperformance Performance Options joy.cpl Game Controllers printui Printer User Interface iexpress IExpress Wizard charmap Character Map iexplore Internet Explorer cttune ClearType text Tuner inetcpl.cpl Internet Properties colorcpl Color Management iscsicpl iSCSI Initiator Configuration Tool cmd Command Prompt lpksetup Language Pack Installer comexp.msc Component Services gpedit.msc Local Group Policy Editor compmgmt.msc Computer Management secpol.msc Local Security Policy: displayswitch Connect to a Projector lusrmgr.msc Local Users and Groups control Control Panel magnify Magnifier
    [Show full text]
  • Operational and Administrative Guidance Microsoft Windows 10
    Operational and Administrative Guidance Microsoft Windows 10 and Windows Server Common Criteria Evaluation for Microsoft Windows 10 and Windows Server Version 1803 General Purpose Operating System Protection Profile © 2018 Microsoft Confidential. All rights reserved. Microsoft Windows 10 GP OS Administrative Guidance Copyright and disclaimer The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs-NonCommercial VLicense (which allows redistribution of the work). To view a copy of this license, visithttp://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred.
    [Show full text]
  • Microsoft Windows Server 2019 Version 1809 Hyper-V
    Operational and Administrative Guidance Microsoft Windows Server, Microsoft Windows 10 version 1909 (November 2019 Update), Microsoft Windows Server 2019 version 1809 Hyper-V Common Criteria Evaluation under the Protection Profile for Virtualization, including the Extended Package for Server Virtualization Revision date: January 15, 2021 © 2021 Microsoft. All rights reserved. Microsoft Windows Server and Windows 10 Hyper-V Administrative Guidance Copyright and disclaimer The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs-NonCommercial VLicense (which allows redistribution of the work). To view a copy of this license, visithttp://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious.
    [Show full text]
  • IBM Connect:Direct for Microsoft Windows: Documentation Fixpack 1 (V6.1.0.1)
    IBM Connect:Direct for Microsoft Windows 6.1 Documentation IBM This edition applies to Version 5 Release 3 of IBM® Connect:Direct and to all subsequent releases and modifications until otherwise indicated in new editions. © Copyright International Business Machines Corporation 1993, 2018. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Chapter 1. Release Notes.......................................................................................1 Requirements...............................................................................................................................................1 Features and Enhancements....................................................................................................................... 2 Special Considerations................................................................................................................................ 3 Known Restrictions...................................................................................................................................... 4 Restrictions for Connect:Direct for Microsoft Windows........................................................................ 4 Restrictions for Related Software.......................................................................................................... 6 Installation Notes.........................................................................................................................................6
    [Show full text]
  • Copyrighted Material
    11_783269 bindex.qxp 11/10/06 11:15 AM Page 209 Index applications (defined), 205. See also programs Numerics arranging windows, 43–44 100% button (Internet Explorer 7), 99–100 assigning sounds to program events, 24 audio visualizations, 186 A Windows Media Player 11, 183, 185–186 accessibility options, 156 audio CDs. See CDs accessories, 205 Audio Description feature, 157 account types, 169 AutoComplete feature (Internet Explorer 7), 101 accounts (administrative), 169 automatic updates with Windows Update, 161–162, 167 accounts (e-mail), 124 AutoPlay, 13, 148, 151 accounts (user) Autosearching feature (Internet Explorer 7), 113 account types, 169 adding, 169 creating, 169 B deleting, 170 backgrounds for desktop, 24 managing, 168, 170 Backup and Restore Center, 140–143, 146 names, 169 Backup Files dialog box, 141 Parental Controls, 170 backups passwords, 169 CompletePC Backup utility, 140–142 pictures, 169–170 DVD discs, 142 switching, 74 File and Folder Backup utility, 140–142 User Account Control (UAC), 170 Send To shortcut menu command, 64–65 activity reporting, 165 stopping, 141 activity reports, 166 BitLocker drive encryption, 163–164 Add Printer Wizard, 149–151 blocking Add to Library dialog box, 187 computer use, 165 adding Web sites, 165 bookmarks to Favorites Center, 102 blog, 208 gadgets, 31–32 bookmarks (Internet Explorer 7) icons, 35 adding to Favorites Center, 102 languages, 155–156 deleting, 104 music, 187 importing, 101 printers, 149–151 moving, 103–105 user accounts, 169 organizing, 103–105 address bar, 15–16 renaming, 104 address book, 128–130 selecting, 103 Address toolbar, 41 browser (defined), 208. See also Internet Explorer 7 adjusting volume, 152 browsing offline.
    [Show full text]
  • Security in Ordinary Operating Systems
    39 C H A P T E R 4 Security in Ordinary Operating Systems In considering the requirements of a secure operating system,it is worth considering how far ordinary operating systems are from achieving these requirements. In this chapter, we examine the UNIX and Windows operating systems and show why they are fundamentally not secure operating systems. We first examine the history these systems, briefly describe their protection systems, then we show, using the requirements of a secure operating system defined in Chapter 2, why ordinary operating systems are inherently insecure. Finally, we examine common vulnerabilities in these systems to show the need for secure operating systems and the types of threats that they will have to overcome. 4.1 SYSTEM HISTORIES 4.1.1 UNIX HISTORY UNIX is a multiuser operating system developed by Dennis Ritchie and Ken Thompson at AT&T Bell Labs [266]. UNIX started as a small project to build an operating system to play a game on an available PDP-7 computer. However, UNIX grew over the next 10 to 15 years into a system with considerable mindshare, such that a variety of commercial UNIX efforts were launched. The lack of coherence in these efforts may have limited the market penetration of UNIX, but many vendors, even Microsoft, had their own versions. UNIX remains a significant operating system today, embodied in many systems, such as Linux, Sun Solaris, IBM AIX, the various BSD systems, etc. Recall from Chapter 3 that Bell Labs was a member of the Multics consortium. However, Bell Labs dropped out of the Multics project in 1969, primarily due to delays in the project.
    [Show full text]
  • Operational and Administrative Guidance
    Operational and Administrative Guidance Microsoft Windows Server, Microsoft Windows 10 version 1909 (November 2019 Update), Microsoft Windows Server 2019 version 1809 Hyper-V Common Criteria Evaluation under the Protection Profile for Virtualization, including the Extended Package for Server Virtualization Revision date: January 15, 2021 © 2021 Microsoft. All rights reserved. Microsoft Windows Server and Windows 10 Hyper-V Administrative Guidance Copyright and disclaimer The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs-NonCommercial VLicense (which allows redistribution of the work). To view a copy of this license, visithttp://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious.
    [Show full text]
  • Net Use User Password Example
    Net Use User Password Example Jerold often mutualised contradictively when remissible Luce ensanguines severely and dissolvings her avarices. Abdul often conquers scot-free when drilled Everard underplays yesterday and antes her serialism. Passional and goosy Johnnie fine his stinkstone concentrated knob dissipatedly. This net logon service enabled in us say you might be edited in email. Nasa show you need put in exploitation such as a category, if one yourself too large for example of your trusted domains. Actually somehow use some use with user password and share unit to account the share1. How it connects manually disconnect. Example if we blow to map drive letter U to incorporate share uscprojects we'd. The passwords in between those commands below you might see more options below are two lines that when their respective windows. Infrastructure PenTest Series Part 3 Exploitation tech. MS-DOS and Windows command line net command. For example include following entries are equivalent if entered between Jan. Windows mapped drives what the hell is strain on. How to map network part from command line. Thank you get when net send us in. Use eDirectory identifier variable in login script NET USE. This code will be loaded when they are some examples how it maps my previous example of. Smbclient U user L 192161122 Enter SAMBAuser's password Sharename Type Comment -------- --- ------ print Disk. Make sure them you have his guest user account password before mounting the. Net commandUser Wikiversity. How can register change my user-account password from a Command Prompt. Net net I httpsCBDBcenterbasecomfilesystem USERPASSWORD. You use free Net Continue command to restart a service loss has been paused by what Net.
    [Show full text]
  • How to Get Started with Third Wall
    How to get started with Third Wall So now you have Third Wall, and you're trying to figure out the best way to use all of that power at your fingertips. Not a bad problem to have! We have a good suggestion on how to get started. You'll notice that, with 56 different policies to apply, some will impact end-users more than others. The ones that impact end users the least (while still providing great protection, of course!) are what we call "no-brainers." That is, you should be deploying many of these across ALL of your managed computers - right now. And, using our Profile feature, we make that easy for you to do. How do you do that? Simply create a Profile in Third Wall with the following no-brainer policies that are appropriate for you. Once you have done that, apply the Profile and select the "All Clients" option, which will then turn these policies on at ALL of your managed Locations - just like that. Pretty slick. Then, you can customize each of your clients by setting up a separate Profile for each of them, then deploy those Profiles by single client on top of your original deployment of the no-brainers. Since Profiles are additive, this will allow you to layer your Profile deployments like this for maximum protection in minimum time. So here is our suggested list of no-brainer policies: 1. Rename Local Administrator Account Why would you ever leave the name of this as default (Administrator)? Hide the name – make it harder for malware to find.
    [Show full text]
  • User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems
    This paper appears at the 33rd IEEE Symposium on Security and Privacy (Oakland 2012). User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems Franziska Roesner, Tadayoshi Kohno Alexander Moshchuk, Bryan Parno, Helen J. Wang Crispin Cowan ffranzi, [email protected] falexmos, parno, [email protected] [email protected] University of Washington Microsoft Research Microsoft Abstract— Modern client platforms, such as iOS, Android, Thus, a pressing open problem is how to allow users to Windows Phone, Windows 8, and web browsers, run each ap- grant applications access to user-owned resources: privacy- plication in an isolated environment with limited privileges. A and cost-sensitive devices and sensors (e.g., the camera, GPS, pressing open problem in such systems is how to allow users to grant applications access to user-owned resources, e.g., to or SMS), system services and settings (e.g., the contact list privacy- and cost-sensitive devices like the camera or to user or clipboard), and user content stored with various applica- data residing in other applications. A key challenge is to en- tions (e.g., photos or documents). To address this problem, able such access in a way that is non-disruptive to users while we advocate user-driven access control, whereby the system still maintaining least-privilege restrictions on applications. captures user intent via authentic user actions in the context In this paper, we take the approach of user-driven access con- trol, whereby permission granting is built into existing user ac- of applications. Prior work [22, 32, 33] applied this principle tions in the context of an application, rather than added as an largely in the context of least-privilege file picking, where an afterthought via manifests or system prompts.
    [Show full text]
  • Nine Ways to Restrict End-Users Who Have Windows Admin Privileges
    WHITE PAPER: Nine Ways to Restrict End-Users Who Have Windows Admin Privileges Nine Ways to Restrict End-Users Who Have Windows Admin Privileges WHITE PAPER WHITE PAPER: Nine Ways to Restrict End-Users Who Have Windows Admin Privileges Contents Introduction ................................................................................................................................3 Restriction 1 – Prevent Users from Changing the UAC Setting ...............................................3 Restriction 2 – Prevent Users from Running the MMC with Admin Privileges.........................4 Restriction 3 – Prevent Users from Running Commands or Scripts with Admin Privileges ....5 Restriction 4 – Prevent Users from Uninstalling Third-party Software Protecting Your System ...................................................................................................................................................6 Restriction 5 – Prevent Users from Being Able to Edit System Settings in the Registry .........7 Restriction 6 – Prevent Users from Disabling or Changing Endpoint Firewall Settings ..........7 Restriction 7 – Prevent Users from Changing the Date and Time ...........................................8 Restriction 8 – Prevent Users from Terminating Processes ....................................................9 Restriction 9 – Prevent Users from Elevating Applications that Could Introduce Malware .....9 What Next? ............................................................................................................................
    [Show full text]