Gallery: Use Steadystate to protect your settings

Before installing Windows Steadystate, it would be sensible to perform a number of maintenance tasks to ensure that the PC is in a good working state. Start by defragmenting all available hard disks – click the Start button, followed by All Programs, followed by Accessories, then System Tools before finally clicking Disk Defragmenter. Hold down the Ctrl key and click all listed hard disks, then click the Defragment button. When this is complete – it could take a while – visit Microsoft Update to download all the latest updates for Windows, then update your anti-virus software. It is also important to ensure that the Administrator account is password protected – do this by opening the User Accounts option in the Control Panel.

Now pay a visit to the Windows Steadystate website at www.microsoft.com/windows/products/winfamily/ sharedaccess and click the Download button. Click the Continue button to validate Windows XP, allowing the Windows Genuine Advantage to run. Once validation is complete, click the Download button and save the setup file to the Windows Desktop. Now locate and double-click the SteadyState_Setup_ENU.exe file just downloaded and click the Run button to continue. Read and agree to the terms of the licence, click Next, then use the button to validate Windows once again before working through the remainder of the installation process and clicking Finish.

Launch steadystate from the Start menu or by using the Desktop shortcut and close the help window that opens automatically. To the right of the screen that appears, a list of existing user accounts will be displayed, with the exception of the Administrator account. If all the required accounts have not yet been created, click the ‘Add a New User’ link, enter a name and password and click OK. To apply restrictions to an existing account, click on it in the list, enter the relevant password, then click OK.

On the General tab, it is possible to prevent the user from making permanent changes to their account by ticking the first of the boxes (‘Lock profile…’): the next time they log in, their account will have reverted to its previous settings. By ticking either of the two boxes labelled ‘Log off after’, users can have time restrictions placed on their computer usage. If this option is selected, it’s a good idea to also choose the option to display the ‘session countdown’ so there is time for the user to save files before an automatic log-off.

Move to the Windows Restrictions tab and users can be prevented from accessing certain features of Windows. Four restriction levels are available by default – High, Medium, Low and No restrictions – but by ticking and unticking boxes in the column to the right, these restrictions can be customised as required. The top of the list includes a range of restrictions that can be applied to the Start menu, including hiding links to features such as the Control Panel to make it more difficult to access.

Scroll further down the list of available restrictions and a range of other security options are available, such as blocking access to the Registry Editor, disabling the auto-play facility and preventing users from creating CDs and DVDs. At the bottom of the screen, a list of hard disks and removable drives is displayed. By ticking the box next to any of these drives, they can be hidden from users, thereby making them harder to access. This is a handy way to block access to various removable media.

Move to the Feature Restrictions tab to place restrictions on Internet Explorer and Microsoft Office. Again, four default restriction levels are available, but these can be customised as required. At the bottom of the screen, the home page for a user can be defined, and internet access can be disabled completely or restricted by ticking the box labelled ‘Prevent internet access’. To allow access only to a limited number of websites, make sure that this box is ticked, then enter permitted URLs in the text box at the bottom of the screen.

The options available for Internet Explorer should be self-explanatory and generally involve hiding certain tools or blocking access to them. Scroll down the list to access options for Microsoft Office. Disabling Visual Basic for Applications is a quick and easy way of making Office safer from viruses, while blocking the Add-ins menu will mean that users are not only unable to remove any existing add-ins, but will not be able to install more or make other modifications to them.

Now move to the Blocked Programs tab. The list to the left of the screen displays all the programs that are currently installed. Individual programs can be blocked by selecting them from the list and clicking the Block button to move them to the right-hand column – all programs can be blocked by clicking Block All. If an installed program is not listed, click the Browse button and select the program, then click OK to return to the main screen.

Once restrictions have been put in place for users, it is advisable to back up these settings so that they can be quickly reapplied should Windows ever be reinstalled. Click the Export User link in the lower right-hand corner of the screen and navigate to the folder in which the backup should be created. From the User Name dropdown menu, select the user that is to be backed up, then click Save before repeating the process for any other user accounts that have been restricted.

As well as applying restrictions to individual user accounts, it is also possible to restrict all users’ accounts by configuring system-wide settings that affect everyone. In the Global Computer Settings section of the main screen, click the Set Computer Restrictions link. To hide information about user accounts from the Windows startup screen, untick the box at the bottom of the option labelled ‘Turn on the Welcome screen’ – the top option in the Privacy Settings section should also be enabled to prevent other user names from being displayed.

Most of the options in the Security Settings section are reasonably straightforward, with the possible exception of ‘Prevent users from opening Microsoft Office documents from within Internet Explorer’. It is often possible to open Office files in Internet Explorer, which will bypass any restrictions that have been placed on such files for individual users. By blocking this ability, Office files will be opened normally so that restrictions will apply. Some security settings require Windows to be restarted before they come into force.

Installing the latest Windows Updates is vital for the security of any computer. Click the Schedule Software Updates link on the main screen, then select the option labelled ‘Use Windows Steadystate to automatically download and install updates’, before using the dropdown menus to choose how often Windows should check for updates. The tool can also be used to automatically download updates for a number of supported programs, and if any of these are installed, they will be listed in the Security Program Updates box – just tick those that should also be automatically updated.

The final, and perhaps most important, feature of Windows Steadystate is disk protection. This can be accessed by clicking the ‘Protect the Hard Disk’ option on the main screen: use it to wipe out any changes made by users so user accounts start in the same state each time they’re accessed. Select the On option, wait for the required cache file to be created and restart when prompted. Now choose between removing changes every time Window is restarted or until a specific date. Note that disk protection will remove any new documents saved in the My Documents folder, so use it with great care. To avoid this, documents must be stored in a different partition.

The final, and perhaps most important, feature of Windows Steadystate is disk protection. This can be accessed by clicking the ‘Protect the Hard Disk’ option on the main screen: use it to wipe out any changes made by users so user accounts start in the same state each time they’re accessed. Select the On option, wait for the required cache file to be created and restart when prompted. Now choose between removing changes every time Window is restarted or until a specific date. Note that disk protection will remove any new documents saved in the My Documents folder, so use it with great care. To avoid this, documents must be stored in a different partition.