Lock down your PC with Steady State

The majority of Steady State’s options ­ over 80 of them ­ are grouped under the Windows Restrictions and Feature Restrictions tabs.

Among many other things, you can disable right-clicking, remove nearly every Start menu item (even the Shut Down button), and all but cripple Internet Explorer. It’s also possible to prevent access to such elements as the taskbar, registry editor and command prompt. For each of the two tabs, you can pick and mix options manually or choose a pre-set restriction level ­ Low, Medium or High. Choosing High automatically ticks nearly every box.

At the bottom of Windows Restrictions, you’re also given the chance to hide some or all of the PC’s drive letters. On our PC, we hid everything except D: (the DVD burner) and E: (assigned if a memory stick is inserted). That way, no access to the hard disk is permitted, but the user will still be able to play or burn optical media, and open and save documents.

One of the options under Feature Restrictions lets you completely block internet access. If that’s too extreme, you can also create a list of allowable sites. However, access will only be given to pages with a URL exactly matching one in the list. Allowing www.pcw.co.uk, for example, won’t automatically allow www.pcw.co.uk/bestbuys. If you need greater flexibility, try Parental Controls (only in Vista) or Windows Live Onecare Family Safety (www.tinyurl.com/3bnphu).

Blocking programs
Under the Blocked Programs tab, you’ll find two panels: the left-hand one lists all the applications found on the PC; the right-hand one, initially blank, lists all the applications you want to prevent the user running. Click the buttons in the middle to shunt programs back and forth as required. If a program isn’t listed, use the search bar or the Browse button to add it (the program’s main .exe file is what you’re after). For our example PC, we blocked everything except those applications with icons on the user’s desktop.

Protecting the hard disk
Now it’s time to turn your attention to Global Computer Settings. By far the biggest feature here is Disk Protection. By default, this is switched off, but once you enable it, the PC’s system partition (usually C:) will be totally protected against permanent change. When the PC reboots (or at a specified date and time, if you prefer), the partition will revert to its state directly before Disk Protection was enabled. Any changes the user has made will be wiped ­ so will any saved documents, which is why we’re giving the user in our example PC access to optical media and USB memory sticks.

Disk Protection is best used in conjunction with the ‘Restart computer after log off’ option found in the Steady State account’s User Settings (see Setting User Restrictions, above). Unless the PC regularly restarts, Disk Protection will be worthless ­ the system could remain in an altered, compromised state for days or even weeks.

It’s important to remember that Disk Protection is global. It deletes all changes to the system partition, including those made by other, non-Steady State users. If you’re using the PC yourself, with an account of your own, you might be better off leaving Disk Protection disabled and instead locking the Steady State user’s profile ­ an option in the account’s User Settings. With this, the profile ­ including any files stored in My Documents and so on ­ will be wiped and reset whenever the user logs off, although everything else on the hard disk will remain untouched. This setting will also allow you to operate your own account as normal.