• PC World
• » Software
• » Operating Systems

For years, readers have been asking me how they can protect the security and privacy of their Windows settings and files without upgrading to NT. This is like asking how you can secure your home without putting doors in the doorways. Okay, maybe it's not that bad. In truth, you can take several measures to discourage (if not prevent) interlopers from messing with your Windows system and files. Not surprisingly, the most effective of these require you to shell out some cash.

Lock the door. When Windows prompts you for a password at start-up, you may think it's protecting your system, but it's not. Your name and password only tell Windows which user is logging on and which set of preferences to use. Anyone can get to the default desktop simply by clicking Cancel at the password prompt.

Since this password protection is far from adequate, here's a work-around: First, make sure your system discourages tampering when it is running and you're away from your desk. Choose Start, Settings, Control Panel. Double-click Display and then click the Screen Saver tab. Make a selection from the Screen Saver drop-down list, and click Settings. Check "Password protected" and click Change. Enter a new password in each box and click OK. Then locate the .scr file corresponding to your chosen screen saver, right-drag it to your \Windows\Start Menu\Programs\StartUp folder (your path may differ), and choose Create Shortcut(s) Here. The next time you start Windows, the screen saver will start and prompt you for a password.

Secure the network. If you're set to share drives or folders with others on a Microsoft network, you can control how accessible these resources are.

Open My Computer, right-click the drive or folder you want to let others use, and choose Sharing (or choose Properties and then click the Sharing tab). Select Shared As. Type a name that will identify the drive or folder on the network, and then select an access type--Read Only, Full, or Depends on Password. Each option lets you enter a password that users must supply to access the shared item. If you select Depends on Password, you can designate both a Read Only and a Full-Access password and then decide who can be trusted with which password (if any). Don't store any files you don't want to share in the shared drive or folder. Note: This kind of share-level security may not be available on Netware or other networks; ask your system administrator about how to protect your files in non-Microsoft network systems.

Establish policies. Your best free tool for limiting what others can do on your PC is the System Policy Editor. To protect a single system, start by setting up multiple profiles, as if you were going to let other users work on the machine, each with a unique batch of settings.

In Windows 95, double-click the Passwords icon in Control Panel and click the User Profiles tab. Select the second option (it starts with "users can customize their preferences"), then any other options as desired. Follow the prompts to restart the computer. When prompted, type in a name and password, followed by a confirmation of the password. Windows will ask if you want to set up a new profile for this identity. Click Yes. In Windows 98, things are simpler: In Control Panel, double-click the Users icon and follow the on-screen directions in the Enable Multi-user Settings wizard to create a new profile.

Once you've created a profile for yourself, you're ready to use System Policy Editor to restrict those who don't know your password. (If you haven't installed this tool, search for the poledit folder on your Windows CD-ROM in \tools\reskit\netadmin, or download it from Microsoft.) Since you'll be using it to modify the Windows Registry, back up user.dat and system.dat and any .pwl files--preferably to removable media you can keep in a secure place--before you go any further.

Now restart your computer. At the password prompt, click Cancel. Since this is your intended configuration for unauthorized users, set restrictions in this environment. Customize the taskbar and Start menu, removing any items you don't want others to use. Then select Start, Run, type poledit, and click OK. Choose File, Open Registry. Double-click the Local User icon. Navigate through the tree diagram and use the various check boxes to apply restrictions that will prevent damage to your system. Experiment with the settings, but leave yourself a way out in case you decide later to revert to a single-user system; this environment is what you'll get if you do.

To make such a trap door, go to the Local User\System\Restrictions branch (Win 95) or the Local User\Windows 98 System\Restrictions branch (Win 98). Check "Only run allowed Windows applications," click the Show button below this entry, click the Add button in the Show Contents dialog box, type poledit.exe, and click OK twice. Leave yourself a way to run this application (by not disabling the Run box, for instance, or by moving poledit.exe to an obscure folder that's still accessible from Windows). When you're finished, click OK, then choose File, Save and File, Exit. Now anytime intruders click Cancel at the password prompt (Win 9x) or type a new name and password to create a new profile (Win 95), they'll get an extremely limited version of Windows.

Though far from fallible, this approach will make intruding as difficult as possible for any snoop who wants to try.

Protect files. Most users don't want to turn their entire system into a miniature Fort Knox; they just want to password-protect individual files or folders--something Windows won't allow. To prevent accidents or discourage well-meaning family members and coworkers from reading or changing files, you can make the files read-only and hide them from view. First right-click any file and choose Properties. Check the boxes for Read-only or Hidden or both, and click OK. To make the hidden files invisible, choose View, Options (Win 95) or View, Folder Options (Win 98) and click the View tab. Select "Hide files of these types" (Win 95) or "Do not show hidden files" under Hidden Files in the Advanced settings list (Win 98). Click OK. Of course, you may have to reverse some or all of these steps if you want to edit the files yourself. In that case, your best course may be to keep sensitive files on a floppy or Zip disk.

Use utilities. For the best in Windows 9x security, try a third-party security product. Many of these let you password-protect files and folders, wipe a file from your hard disk, and prevent others from using your system. PGP Personal Privacy ($45 shareware from McAfee) encrypts disks, folders, e-mail, and more, to keep your data safe from prying eyes. Download it at FileWorld or from McAfee.