Preventing users from installing software on XP (was: Home network problem)

On 12/30/05, Jones, John (US) <John.Jones@xxxxxxxxxx> wrote:
>
> > Yeah, the firewall will (should) stop the rootkit's "phone home"
> > activity, but doesn't prevent it from being installed in the first
> > place.
>
> There are four ways to prevent or block the installation:
>
> 1. Have the malware be detected & blocked by AV software.
> 2. Have the malware be detecetd & blocked by anti-spyware software.
> 3. Don't allow software to be installed (run as a limited user).
> 4. Don't install software that isn't vital to the operation of the
> machine.
>
> Most folks find 3 to be too limiting, although it can be done.  But
> going back to my comments about the skills of the average home user and
> it just ain't gonna happen.
>
> 4 would be nice, but again in the long run it's not practical.  People
> are used to installing whatever they come across that they think they
> may want/need/like.
>
> So we're left with protecting ourselves from our own follies. 1 & 2 to
> try to stop things from getting on the machine and a FW for things that
> slip by them.  1 & 2 are usually at least a half-step behind the malware
> creaetors so the concern about something getting by them is legitimate.


I broke this off from the original thread since it drifts from the original
topic.

One of the things I thought I was getting when I bought a PC with XP Home on
it to replace the Win98 box was the ability to prevent my kids from
installing *any* software, either accidently or intentionally, by setting
all the users to "limited".  But last night I found an application loaded
that I didn't install.  (Will talk to them about that tonight.)

I have an admin account that I use *only* to do admin stuff, and use a
strong password for it.  Otherwise, I use my user account.

Was my concept of a "limited" user on XP Home wishful thinking?

- Dan