Page 1 of 3

Keyboard Shortcuts

Keyboard shortcuts are combinations of two or more keys that, when pressed, can be used to perform a task that would typically require a mouse or other pointing device. Keyboard shortcuts can make it easier to interact with your computer, saving you time and effort as you work with Windows and other programs. Most programs also provide accelerator keys that can make it easier to work with menus and other commands. Check the menus of programs for accelerator keys. If a letter is underlined in a menu, that usually means that pressing the Alt key in combination with the underlined key will have the same effect as clicking that menu item. Pressing the Alt key in some programs, such as Paint and WordPad, shows commands that are labeled with additional keys that you can press to use them.

Windows system key combinations

• F1: Help
• CTRL+ESC: Open Start menu
• ALT+TAB: Switch between open programs
• ALT+F4: Quit program
• SHIFT+DELETE: Delete item permanently
• Windows Logo+L: Lock the computer (without using CTRL+ALT+DELETE)

Windows program key combinations

• CTRL+C: Copy
• CTRL+X: Cut
• CTRL+V: Paste
• CTRL+Z: Undo
• CTRL+B: Bold
• CTRL+U: Underline
• CTRL+I: Italic

Mouse click/keyboard modifier combinations for shell objects

• SHIFT+right click: Displays a shortcut menu containing alternative commands
• SHIFT+double click: Runs the alternate default command (the second item on the menu)
• ALT+double click: Displays properties
• SHIFT+DELETE: Deletes an item immediately without placing it in the Recycle Bin

General keyboard-only commands

• F1: Starts Windows Help
• F10: Activates menu bar options
• SHIFT+F10 Opens a shortcut menu for the selected item (this is the same as right-clicking an object
• CTRL+ESC: Opens the Start menu (use the ARROW keys to select an item)
• CTRL+ESC or ESC: Selects the Start button (press TAB to select the taskbar, or press SHIFT+F10 for a context menu)
• CTRL+SHIFT+ESC: Opens Windows Task Manager
• ALT+DOWN ARROW: Opens a drop-down list box
• ALT+TAB: Switch to another running program (hold down the ALT key and then press the TAB key to view the task-switching window)
• SHIFT: Press and hold down the SHIFT key while you insert a CD-ROM to bypass the automatic-run feature
• ALT+SPACE: Displays the main window's System menu (from the System menu, you can restore, move, resize, minimize, maximize, or close the window)
• ALT+- (ALT+hyphen): Displays the Multiple Document Interface (MDI) child window's System menu (from the MDI child window's System menu, you can restore, move, resize, minimize, maximize, or close the child window)
• CTRL+TAB: Switch to the next child window of a Multiple Document Interface (MDI) program
• ALT+underlined letter in menu: Opens the menu
• ALT+F4: Closes the current window
• CTRL+F4: Closes the current Multiple Document Interface (MDI) window
• ALT+F6: Switch between multiple windows in the same program (for example, when the Notepad Find dialog box is displayed, ALT+F6 switches between the Find dialog box and the main Notepad window)

Page 2 of 3

Shell objects and general folder/Windows Explorer shortcuts

For a selected object:

• F2: Rename object
• F3: Find all files
• CTRL+X: Cut
• CTRL+C: Copy
• CTRL+V: Paste
• SHIFT+DELETE: Delete selection immediately, without moving the item to the Recycle Bin
• ALT+ENTER: Open the properties for the selected object

To copy a file

Press and hold down the CTRL key while you drag the file to another folder.

To create a shortcut

Press and hold down CTRL+SHIFT while you drag a file to the desktop or a folder.

General folder/shortcut control

• F4: Selects the Go To A Different Folder box and moves down the entries in the box (if the toolbar is active in Windows Explorer)
• F5: Refreshes the current window.
• F6: Moves among panes in Windows Explorer
• CTRL+G: Opens the Go To Folder tool (in Windows 95 Windows Explorer only)
• CTRL+Z: Undo the last command
• CTRL+A: Select all the items in the current window
• BACKSPACE: Switch to the parent folder
• SHIFT+click+Close button: For folders, close the current folder plus all parent folders

Windows Explorer tree control

• Numeric Keypad *: Expands everything under the current selection
• Numeric Keypad +: Expands the current selection
• Numeric Keypad -: Collapses the current selection.
• RIGHT ARROW: Expands the current selection if it is not expanded, otherwise goes to the first child
• LEFT ARROW: Collapses the current selection if it is expanded, otherwise goes to the parent

Properties control

• CTRL+TAB/CTRL+SHIFT+TAB: Move through the property tabs

Accessibility shortcuts

• Press SHIFT five times: Toggles StickyKeys on and off
• Press down and hold the right SHIFT key for eight seconds: Toggles FilterKeys on and off
• Press down and hold the NUM LOCK key for five seconds: Toggles ToggleKeys on and off
• Left ALT+left SHIFT+NUM LOCK: Toggles MouseKeys on and off
• Left ALT+left SHIFT+PRINT SCREEN: Toggles high contrast on and off

Microsoft Natural Keyboard keys

Page 3 of 3

• Windows Logo: Start menu
• Windows Logo+R: Run dialog box
• Windows Logo+M: Minimize all
• SHIFT+Windows Logo+M: Undo minimize all
• Windows Logo+F1: Help
• Windows Logo+E: Windows Explorer
• Windows Logo+F: Find files or folders
• Windows Logo+D: Minimizes all open windows and displays the desktop
• CTRL+Windows Logo+F: Find computer
• CTRL+Windows Logo+TAB: Moves focus from Start, to the Quick Launch toolbar, to the system tray (use RIGHT ARROW or LEFT ARROW to move focus to items on the Quick Launch toolbar and the system tray)
• Windows Logo+TAB: Cycle through taskbar buttons
• Windows Logo+Break: System Properties dialog box
• Application key: Displays a shortcut menu for the selected item

Microsoft Natural Keyboard with IntelliType software installed

• Windows Logo+L: Log off Windows
• Windows Logo+P: Starts Print Manager
• Windows Logo+C: Opens Control Panel
• Windows Logo+V: Starts Clipboard
• Windows Logo+K: Opens Keyboard Properties dialog box
• Windows Logo+I: Opens Mouse Properties dialog box
• Windows Logo+A: Starts Accessibility Options (if installed)
• Windows Logo+SPACEBAR: Displays the list of Microsoft IntelliType shortcut keys
• Windows Logo+S: Toggles CAPS LOCK on and off

Dialog box keyboard commands

• TAB: Move to the next control in the dialog box
• SHIFT+TAB: Move to the previous control in the dialog box
• SPACEBAR: If the current control is a button, this clicks the button. If the current control is a check box, this toggles the check box. If the current control is an option, this selects the option.
• ENTER: Equivalent to clicking the selected button (the button with the outline)
• ESC: Equivalent to clicking the Cancel button
• ALT+underlined letter in dialog box item: Move to the corresponding item

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See (http://go.microsoft.com/fwlink/?LinkId=151500) for other considerations.

   Printer Friendly - This link will open in a new window.

Page 1 of 4

Basic CD Burning

Burn Baby Burn!

So you finally managed to convince your parents (or bribed your wife) into letting you buy the CD burner. You got it in the mail yesterday, and 10 minutes later, it was added to your already exorbitant arsenal of computer gadgetry. So now what? How exactly do you burn things? And why is it called burning anyway? It sounds so destructive. Well, have no fear, because this article will guide you through the world of CD burning in a step-by-step fashion. Before you know it, you'll be burning like a pro.

How it all works

One of the questions that everyone inevitably asks is "why is it called burning?" To answer that question, let's step back and take a look at how a CD actually works. Remember that all computer data, regardless of what type, is stored as zeros and ones. The computer then interprets the zeros and ones to make sense out of the madness. We used to have punch cards that did the trick. Now we have hard drives that store data in magnetic form. CDs are no different. On a CD, the "roughness" of the CD's surface represents the zeros and ones. This may come as a shock to you, since a CD's surface appears seemingly smooth to you. But make no mistake about it, there are incredibly small pits and grooves etched on the surface of the CD. Each pit represents a bit of data. (So the more pits you can pack into a CD, the more data it can store. Currently, normal CDs store about 650MB of data, or 74 minutes of audio.) When a CD is inserted into the CD-ROM drive, a small laser inside the CD-ROM drive is shot onto the surface of the CD. After the laser hits the surface, it will be reflected off the CD's surface. The reflected light is then intercepted by a series of mirrors and sensory devices, which analyzes the light and determines the bit the light represents. The digital signal processor in the CD basically analyzes the brightness of the reflected light. If the brightness is above a certain threshold, it is interpreted as a one. Otherwise, it is a zero. The brightness of the reflected light is directly related to the pits and grooves on the CD. If the light reflected off a huge pit in the CD, then the reflection would not be very bright. (because of scattering. Just as your image, viewed in a worn down mirror, will not be very clear.) Thus, a large pit is interpreted as a zero. Conversely, a smooth area on the CD, called lands, would reflect very well, and thus is interpreted as a one.

So now that we have a basic understanding of how CDs actually work, it's time to take a look at how CD writers perform their magic. If you've ever seen the backside of a brand new, unwritten, CDR disc (So yes, there are blank CDs. You can buy them at most of your major computer retailers, like Comp USA, or Best Buy.), you would notice that it is surprisingly reflective. A blank CD, in fact, has no pits (for the experts reading this article, I am of course making a oversimplification by ignoring the pre-grooved spiral track layer used to guide the burning laser). So if your computer were to scan the CD, it would read all zeros. When you actually write data on to the CD (and we'll be getting to that a little bit later in the article), the laser inside the CDR drive (from this point on, I will be referring to all types of CD writing drives as CDR) actually heats the surface of the blank CD up so that the chemical coating of the CD will react and form a pit. That is why most people refer to CD Copying as CD burning. In essence, you are burning a pit into the CD. Once the CD is written, you will notice that the backside is no longer as reflective as it used to be. The pits are now on the CD, and they don't reflect as much light as the smooth surface. There you have it - the magic behind CD writing.

Page 2 of 4

Learning the Language

Right about now, you are probably really impatient and ready to burn your first CD. My answer to you: Not so fast! Before you start burning anything, let's make sure you understand some of the basic terminology used in CD writing. Because if you don't, you'll find yourself knee deep in coasters. And there is our first term - coaster. A coaster refers to a CDR that was not written correctly. This could happen either because of user error, or hardware/software error. In the bad old days, most coasters were the result of software/hardware error. But today, things are much improved. Most of today's coasters are caused by user error.
Having said that, let's take a look at some of the basic terminology used in CD burning. The most common terms used in CD burning are:

Session
Multi Session
Lead In
Track
TOC
CDDA
ISO-9660
Joliet
Mixed Mode

These terms may seem daunting. But trust me, they are really quite simple. First, data on a CD is organized into tracks. You probably know that from your music CDs. Each song on a music CD is stored on a separate track. You can think of tracks as the basic unit for organizing different types of data on the CD. What exactly are different types of data? We'll get to that in just a little bit. So just remember that every time you write stuff to a CD, you are writing it to a track.

The next term to look at is session. The definition is not too far off from that of a recording session in the music industry. A recording artist goes into the studios to modify her album. Every time she does that, she is in a recording session. The term means the exactly the same in CD writing. Every time you write something to a CD, you are adding another session to the CD. So if you wrote multiple times to the same CDR disc (so for example if you burned Windows 2000 to the CD on Monday, and added Half Life to it on Wednesday), then you've created a multi session CD.

Also related to the word session is the term Lead-In. Lead-In refers to an area at the beginning of a session that stores the session's information, such as where on the CD the session data starts, where it ends, what it contains. It is basically a table of contents for the stuff recorded in the session. For the technical minded, a lead-in takes up 4500 sectors on a CD, which is roughly 9 megabytes of data. That means you cannot create an infinite number of sessions.

A week later, you've got about 7000 files burned onto a CD. You are pretty proud of yourself. But now you wonder... How does the CD keep track (no pun intended) of all those files? The answer lies in the TOC, or Table of Contents. Just as the name may imply, the TOC keeps a long list of every file that's on the CD, their location on the CD, size, etc. Without the TOC, even if the CD is burned full of data, the computer will still think it is blank. If you've dabbed in hard drive partitioning before, the TOC on a CD is the equivalent of your FAT on a disk partition. If you've never heard of FAT before, don't despair. It's not that important. What is important is to understand that the table of contents tells the computer what the CD contains.

Page 3 of 4

Remember a little bit up in the article I mentioned something about different types of data? Well, that's what the last few terms are. They are different data types. What will be covered here is somewhat technical in nature. It is interesting to know, but not necessary for CD burning.

First up is CDDA. CDDA refers to CD Digital Audio. It is the file format used to store audio data, like the music on your Backstreet Boys album. Sony and Phillips jointly developed the standard back in October of 1982. This standard is also known as Red Book. Another term is ISO 9660. This is the file format used to store data files on a CD, such as directories, word documents, MP3 files, etc. The one major limitation of this international standard is that its file names had an 8.3 limit, reminiscent of the bad old DOS days. However, in today's Windows 9x driven world, 8.3 filenames are no longer acceptable. Hence, a new file format has been created to fill the gap created by ISO 9660. That file format is Joliet. The biggest improvement Joliet has over ISO is that it allows for long filenames and directory names. And finally, a Mixed Mode CD is a CD that contains both data files and audio files. Typically, all the data is stored as the last session on the CD, and all the audio is stored as the first session (more on why later in the article).

There are of course many other terms. But the intention of this section is not to inundate you with every possible vocabulary word. Rather, the main purpose of this section is to get you familiar with the most basic terminology. In the following sections I will gradually introduce you to some of the other terms as the time becomes appropriate.

Starting The Fire

Now that we have a basic understanding of how CDRs work, it's time to burn our first CD. This section will be divided into three parts. Part I will discuss the procedure for burning Audio CDs. Part II will talk about data CDs. And finally, Part III will discuss the procedure for creating mixed mode CDs. Realize that there are many different programs you can use to write data to a CD, but the general process is the same. This article will be using Adaptec's Easy CD Creator, as it is one of the most popular CD writing programs. More advanced users may opt to use Nero or CDRWIN. For tutorials on those two programs, please refer to the Advanced CD Burning Guide.

Burning Audio CDs

One of the top reasons for buying a CD burner is to compile music CDs. Imagine the annoyance of having to carry 15 CDs on a road trip just so that you can have all 17 of those favorite songs on hand. With a CD burner, you won't have to. All you have to do is copy those 17 favorite tracks onto a single CD and bring that along. The best part of it is that it's fairly easy to do with Easy CD Creator.

The first step to compiling a music CD is to pre-record all the tracks you want into WAV Files, and store it on the hard drive. So what is a WAV file? And what do I mean by pre-record? And why do we need to pre-record? A WAV file is a type of file format used by the computer to store audio data. It is a standard file format that every audio program supports. The music you hear from your music CDs is really just special forms of WAV files. The main advantage to WAV files is that it stores audio data without loss of quality. A WAV file recorded at 16bit Stereo and 44KHz is perfect CD Quality. Yikes!! Look at all those terms!! 16Bits, 44Khz, what the heck are those? 44KHz refers to how many samples the WAV file takes per second. So 44Khz means that when you are recording the WAV file, the system takes 44,000 samples (actually 44,100 samples to be precise) for every second of audio data. This is analogous to a video camera.

Page 4 of 4

A video camera captures 30 frames per second, and turns that into a movie. The 16bit refers to how detailed each sample is. 16 bits means that it takes a series of 16 zeros and ones to describe each sample. Obviously, the higher the bit rate, the better the sound. Think of a song as a movie with different scenes. Each second, 44,100 scenes are played. Now, think of the bits as the number of words used to describe each scene. So 16 bits means it takes 16 words to describe each scene. A lower bit rate, say 8 bits, means only 8 words are used to describe each scene. So take a scene, and let's describe it. In 16 words, I can say "A dark-haired, fair complexioned man is standing in a room filled with a bustling crowd." Now, cut that down to 8 words. "A man is standing in a crowded room." Needless to say, the 16 bit description yields a much more vivid image, just as 16bit audio yields a much more vibrant and realistic audio experience. Finally, stereo just means it records two channels of audio, each one at 44Khz and 16 bits.

Ok, so we know what a WAV file is. But why do we need to convert the audio track from the CDs into WAV files first? I have two CD-ROMs. Why not just record from one to the other, just like the way I dub tapes? There are several reasons for doing this. The first reason is something called buffer underrun. When the computer is writing to a CD, it first reads the source data into a part of memory called a buffer, and from there, it records the data onto the CD. As data is written from the buffer to the CD, that data is removed from the buffer. Thus, it is critical that the data is fed into the buffer at approximately the same rate it is being written to the CD. If the data is being fed into the buffer slower than it is being written to disk, buffer underrun occurs. When buffer underrun occurs, the CDR laser is left waiting for new data. This wait could cause the CD you are burning to be ruined. Buffer underrun happens if the source medium cannot transfer data quickly enough to the buffer. With hard drives, this rarely ever happens. But with CD ROM drivers, especially older IDE based drives, it happens more frequently. Some people make the assumption that since they have CD ROM drives that run at 36X, and their CDR only burns at 4X, that they won't have this problem. That is not necessarily the case. Sometimes the problem occurs not because the drive can't read the data fast enough, but because the data can't be transferred to the buffer fast enough. This is analogous to saying that sometimes you can't get to work fast enough not because your car can't go fast enough, but because the highway is too clogged.

Another problem with doing a CD to CD copy is distortion. With newer CD-ROMs that spin at 36X or higher, the CD is spinning so quickly that it tends to vibrate in the drive. This vibration is known as jittering. With data CDs, it's not a big deal. But with audio CDs, what happens is that you may get distortions in the form of clicks. So to prevent the problem, pre-record the WAV file using your CDR drive, which tends to compensate for the problem.

And the last is the hassle. If you were to compile songs from 10 different CDs, you would need to sit around and wait for the song from each CD to be written, and then insert the next CD. This process quickly becomes tiresome. It's much easier to just pre-record all the songs to the hard drive.

After the WAV file is recorded to disk, the rest is easy. Now start a new CD layout by choosing New from the File menu. Once you start a new CD Layout, find the directory where you stored all your pre-recorded WAV files and drag them into the lower pane in the order you want the tracks to be burned. As you drag more tracks into the lower pane, you will notice an indicator bar at the bottom of the screen that displays how much more time there is available for additional tracks. Be sure not to go over the 74 minute limit. Once you have finished designing your CD Layout, it's time to burn. But before you click the record button, you should be aware of a problem known as the 2 second gap. Basically, the audio track ends two seconds earlier, and you hear a 2 second silence between tracks. To fix the problem, you will need to write the CD in disc-at-once mode. During a normal CD writing process, the laser is turned off between tracks, which causes the 2 second gap problem. But in disc-at-once mode, the CD is written in one turn, without ever turning off the laser. This will effectively eliminate the 2 second gap problem. To write in disc-at-once mode, do the following:

• Click on the red Record button in the toolbar.
• Next, click on the Advanced tab
• In the Advanced tab, choose Disc-at-once

Note, however, that there is a slight disadvantage to using disc-at-once, and that is disc-at-once will prevent you from making further additions to the CD. This really isn't a problem with audio CDs, since most compilations are one time deals. The advantages, in my opinion, outweigh the drawbacks. For one, disc-at-once eliminates the 2-second gap problem. Disc-at-once also ensures higher compatibility with older CD players (because it closes the disc after the write. More on that in the advanced guide to CD burning). So, whenever possible, use disc-at-once to write your audio CDs.

And as a teaser, if you think writing normal CDs are fun, wait till you see the advanced guide. In there I will show you how to encode an AC3 compliant Audio track onto a CDR disc that will play in normal home theatres.

   Printer Friendly - This link will open in a new window.

FAT32 or NTFS: Making the Choice

Choosing the file system to use on a Windows XP system is seldom easy, and frequently it's not just a one time decision.. Different factors can blur the decision process, and some tradeoffs are more than likely. No matter what method you choose to adopt Windows XP, you will have to face the FAT32 versus NTFS decision. Clean and upgrade installs both require you to address the situation early on in the process. Later on, if you add a drive or repartition an existing drive the decision process faces you yet again. Circumstances may dictate the choice for you, but in most cases the options have to be weighed and the tradeoffs of using each method analyzed. Let's look at the available choices.

File System Choices

Most articles discussing file system choices look at FAT32 and NTFS as the two available choices. In reality, there are three systems which could be selected. FAT, FAT32, and NTFS. Granted, FAT32 and NTFS are the primary choices, but on occasion you'll still find the need for a FAT volume. A FAT volume has a maximum size of 2GB and supports MS-DOS as well as being used for some dual boot configurations, but backward compatibility is about the only reason I can think of that FAT should ever be used, other than for the occasional floppy diskette. That said, let's move on to FAT32 and NTFS.

Which File System to Choose?

As much as everyone would like for there to be a stock answer to the selection question, there isn't. Different situations and needs will play a large role in the decision of which file system to adopt. There isn't any argument that NTFS offers better security and reliability. Some also say that NTFS is more flexible, but that can get rather subjective depending on the situation and work habits, whereas NTFS superiority in security and reliability is seldom challenged. Listed below are some of the most common factors to consider when deciding between FAT32 and NTFS.

Security

FAT32 provides very little security. A user with access to a drive using FAT32 has access to the files on that drive.

NTFS allows the use of NTFS Permissions. It's much more difficult to implement, but folder and file access can be controlled individually, down to an an extreme degree if necessary. The down side of using NTFS Permissions is the chance for error and screwing up the system is greatly magnified.

Windows XP Professional, Vista and Windows 7 support file encryption.

Compatibility

NTFS volumes are not recognized by Windows 95/98/Me. This is only a concern when the system is set up for dual or multi-booting. FAT32 must be be used for any drives that must be accessed when the computer is booted from Windows 95/98 or Windows Me.

An additional note to the previous statement. Users on the network have access to shared folders no matter what disk format is being used or what version of Windows is installed.

FAT and FAT32 volumes can be converted to NTFS volumes. NTFS cannot be converted to FAT32 without reformatting.

Space Efficiency

NTFS supports disk quotas, allowing you to control the amount of disk usage on a per user basis.

NTFS supports file compression. FAT32 does not.

How a volume manages data is outside the scope of this article, but once you pass the 8GB partition size, NTFS handles space management much more efficiently than FAT32. Cluster sizes play an important part in how much disk space is wasted storing files. NTFS provides smaller cluster sizes and less disk space waste than FAT32.

In Windows XP, the maximum partition size that can be created using FAT32 is 32GB. This increases to 16TB (terabytes) using NTFS. There is a workaround for the 32GB limitation under FAT32, but it is a nuisance especially considering the size of drives currently being manufactured.

Reliability

FAT32 drives are much more susceptible to disk errors.

NTFS volumes have the ability to recover from errors more readily than similar FAT32 volumes.

Log files are created under NTFS which can be used for automatic file system repairs.

NTFS supports dynamic cluster remapping for bad sectors and prevent them from being used in the future.

The Final Choice

As the prior versions of Windows continue to age and are replaced in the home and workplace there will be no need for the older file systems. Hard drives aren't going to get smaller, networks are likely to get larger and more complex, and security is evolving almost daily as more and more users become connected. For all the innovations that Windows 95 brought to the desktop, it's now a virtual dinosaur. Windows 98 is fast on the way out and that leaves NT and Windows 2000, both well suited to NTFS. To wrap up, there may be compelling reasons why your current situation requires a file system other than NTFS or a combination of different systems for compatibility, but if at all possible go with NTFS. Even if you don't utilize its full scope of features, the stability and reliability it offers make it the hands down choice.

   Printer Friendly - This link will open in a new window.

How To Build a Secure Windows XP Desktop From Scratch

Page 1 of 6

You can save a lot of future trouble by maximizing security when you first install Windows XP on a new PC. Here's how.

By Jason Compton - Courtesy of TechBuilder.org

Here's a fact that may surprise, even shock, you: The most important weapon in the battle for desktop security is not a robust IT infrastructure, or even the latest security upgrades. Instead, the most powerful weapons are steps the system builder takes during the initial build.
As you know, desktop security has become a constant battle. There are no clear victories, only the ongoing triumph of a smoothly-operating computer. The Internet today is awash with viruses, trojans, spyware, spam, and many other exploits that can bring your clients' systems to a halt. Unfortunately, many small businesses lack the IT resources needed to protect their systems against these various onslaughts. That's why desktop security for small business must start with the initial build.

The good news is that any system builder can build safer, more secure PCs by bundling just a few items in with a desktop and making a few non-invasive tweaks to a Windows configuration. In this TechBuilder Recipe, I'll show you how to build systems that will help your clients fend off many common security exploits and vulnerabilities to keep their systems up and smoothly running.

Ingredients

Ultimately, a PC's configuration of memory, networking, and storage capacity is a matter decided between your client and you. But several key elements are all important to a secure build. You should discuss the following with all your clients:

At least one spare USB port: With the advent of high-capacity, small form factor hard drives, every open port on a PC must be seen as a security risk. Yet to support either hardware encryption (described later in this Recipe) or biometric authentication, the system will need at least one port open after the keyboard, mouse, and all other peripherals are accounted for. The alternative -- requiring users to add their own USB hubs " only expands the risk.

Windows XP Professional: Yes, the Home version is cheaper and for businesses that won't grow past a few PCs or make much use of Windows networking, they may not think they care. But Home is actually harder to secure. Some of its networking modes are kept open for ease-of-use, and that's bad for business environments.

Spyware protection: Much like fighting a deadly disease, there is no one solution to spyware. Instead, a "cocktail" of remedies should be applied to address the most common root causes and side effects. For this Recipe, I used Lavasoft's AdAware and Microsoft's Security Essentials tool.

Virus protection: Unlike the spyware problem, virus protection is reasonably well-understood and commoditized. Threat data is documented and propagated between security labs rather quickly. So your vendor of choice is likely suitable for the client desktop. For this Recipe I used GRISoft's AVG Anti-Virus.

WinXP Service Pack 3 on CD-ROM: If your Windows XP OEM versions are not yet carrying Service Pack 3, obtain the administrator's version of Service Pack 3 from Microsoft.com and burn it to a convenient CD-R.

Page 2 of 6

Firefox (optional): While you should discuss this with the client before you foist it on their users, the browser is one of the primary vectors for exploits, and a number of exploits attack Internet Explorer specifically. True, improvements in Service Pack 3 significantly strengthened IE's defenses. But Firefox is still less susceptible to common exploits, and the software is updated on a nightly basis. By comparison, IE's update schedule is long and slow. Ideally, Firefox should be the default browser.

Hardware encryption token: Windows XP provides built-in encryption capabilities. But the decryption is tied to software only (that is, the user's password), unless the client environment has a more elaborate domain authentication scheme, which many small businesses lack. There are a variety of options in this space, including random-number tokens and plug-in authentication. For this Recipe, I used DESLock+ from Data Encryption Systems. It's a USB hardware token system for a single-user deployment.

25 Steps Toward Building a Secure Windows XP Desktop

Now that you have all your components assembled, let's start building a secure desktop system.

1. Assemble the desktop system to the client's specifications. Do not connect it to a network yet. If you have a wireless radio in the machine and a WLAN in your lab, ensure that the WLAN is either on an access key, restricted to certain MAC addresses, or both, so that outside machines cannot see the new computer yet.

2. Install Windows XP. Assign the initial administrator account either as a temporary account that will later be removed, or to the specification of the client's IT manager. Do not configure the end-user account yet.

3. Now that Windows is installed, users no longer have any cause to boot from CD, a common security exploit. Reboot the machine and enter the BIOS setup using the assigned key (commonly ESC, DEL, or F12). Find the boot device priority list -- it's often in Advanced BIOS Settings or Boot Options -- and remove CD-ROM and Diskette from the list. Ideally, hard-drive partition C (or IDE-0, for the primary hard drive on the system) will be the only option listed in the boot priority.

4. If the BIOS offers a password-protection to enter the BIOS screen, assign one now, and make a note for the client's sysadmin. But remember, a BIOS entry password is not the same thing as a BIOS password to boot the computer. You may wish to assign that as well, but it's less critical if good password policies are enforced in Windows. What we really want is to keep users from entering the BIOS and making changes that will result in either downtime or potential security holes, such as re-activating CD-ROM boot.

5. Reboot back to Windows and log in. Keep the machine isolated from the Internet for as long as possible. If your Windows OEM builds are not Service Pack 3, keep SP3 handy on a CD and install it now, before the machine is connected to the network. If the system must go online before it's fully "hardened," at least keep the system as far from the Net as possible, for example, behind your shop's own firewall and NAT (network address translation).

Page 3 of 6

6. Access the Service Pack 3 Security Center. It will come up automatically after Service Pack is installed for the first time. After that, it is available in Control Panels. Go into the Windows Firewall setting, access the Exceptions list, and turn off anything checked. Here's a screen shot of the Windows Security Center:

7. Go to the System control panel, and select the Remote tab. If Remote Assistance and Remote Desktop are enabled, turn them off. (In Service Pack 3, Remote Desktop should be off by default, but it's always good to check.)

8. If the user wants Mozilla Firefox as their primary Web browser, install Firefox now and allow it to configure itself as the default browser. To improve Firefox's default security settings, select Tools, then Options, then Privacy, and then Cookies. Turn on "for the originating site only." While still in Options, click on Web Features; locate "Allow Web sites to install software," and uncheck that option.

Sooner or later, the user will need to use Internet Explorer. So let's tighten up IE's settings, too. Access the Internet Options control panel, then go to Advanced Settings. Disable Install On Demand, and change the setting for "Search from the Address Bar" to "Do not search from the address bar" or "Just display the results." This will minimize the chances that the user accidentally reaches potentially harmful sites through mistyped URLs or other mistakes in IE's location field.

9. In the Windows Start menu, open the Administrative Tools, and select Local Security Policy / Local Policies / Audit Policy. To improve security auditing after an incident, turn on options to track success and failure of all logon events, policy changes, account management procedures, and policy changes. For added security, track at least the success of all system events, privilege uses, and audit object access. To do so, double-click each line item and check the "success" and "failure" boxes.

Page 4 of 6

10. Make life more difficult for hackers by tightening the display of valid usernames. First, enter the Group Policy control panel. The easiest way to reach this is through the Start/Run command, gpedit.msc. Browse to Computer Configuration/Windows Settings/Security Settings/Local Policy/Security Options, and find "Interactive Logon: Do not display last user name." Double-click and set to Enabled. You may also wish to rename the Administrator account from this interface to discourage obvious hacking attempts. It is under Accounts: Rename administrator account. You can also rename the Guest account in the same way.

11. Consider disabling the Guest account altogether, particularly in environments that use Windows domains rather than workgroup file and print sharing. On new builds, unless workgroup sharing will be used, Guest should not be displayed as a valid user. To kill the Guest, access the User Accounts control panel. Then right-click the Guest account to view its properties. Finally, check Account is Disabled.

12. Install Microsoft's Security Essentials. When installing, allow the software to automatically update itself and run the real-time agent. But stay off the SpyNet community for now—that way, there is less risk that the spyware tool's information-sharing capabilities could be exploited. Once installed, Windows Security Essentials will monitor for unusual behavior.

13. To provide a second anti-spyware opinion, install AdAware from Lavasoft. While Lavasoft offers free versions to private end-users (used here for demonstration purposes only), commercial versions are available for resellers. Ensure that the automatic definition update is functional. That way, AdAware can regularly refresh the banned site list and spyware definition files. Here's a look at AdAware:

14. Install anti-virus protection. Depending on the way the anti-virus program integrates into Windows, you may receive a spyware warning at this point, which you can safely ignore. GRISoft's AVG Anti-Virus is not licensed for corporate use or for reseller distribution, but we will use it here for demonstration purposes only. AVG, like most anti-virus packages, will automatically integrate itself with file changes and the e-mail queue.

Page 5 of 6

15. Make it hard for uncredentialed users to browse shared folders and files, especially if the machine will be on a domain. Do this by disabling Simple File Sharing. Start by selecting the Tools/Options/View tab in any Windows Explorer window. Then disable "Use simple file sharing."

16. Now that the critical applications have been installed, create a Limited account for the computer's end user from Control Panels, User Account. Add the user account with Limited permissions.

17. Consider employing basic NTFS encryption, which is effective against the physical removal of the drive but offers no protection against a user with a credentialed login. Simply right-click a folder (such as My Documents for the Limited day-to-day users of the machine), and select Properties, then Advanced. Enable "Encrypt contents to secure data."

18. To provide encryption that goes deeper than password authentication, you need hardware. Install the DESLock+ software, and get the two provided DK5 USB keys ready. One is the end-user key; the other should be kept as an administrative backup. Each DK5 token has a unique serial number and can store up to 64 keys. So one administrator "key ring" can account for a number of user PCs. Here's a look:

19. After DESLock installs and reboots the computer, the circled D DESLock logo should appear in the tray. If it does not, start DESLock manually from the Start menu. Plug the user DK5 into an open USB port. Let Windows use the recommended drivers, then click the key's serial number and select Setup. Choose Corporate setup if multiple machines will use DESkey. Choose Single User for a solo implementation, a very small business, or a single, highly critical PC. (For this Recipe, I used the Corporate example.) DESLock prompts for a master password that controls access to the higher administrative functions of DESLock. Choose a strong password.

20. In the next step of DESLock setup, designate a tolerated number of bad login attempts, and a consequence for exceeding that amount. Erasing the encryption keys is a drastic remedy, used mainly in situations where you suspect a machine may come under serious attack. A simple time lock will discourage the casual passersby who may meddle with the PC, but not pose a long-term threat. For most circumstances, the default settings -- five failed attempts and time lock -- are appropriate.

Page 6 of 6

21. DESLock now asks which administrative functions should be available to an authenticated user. If users should have the flexibility to swap key access with other machines, turn on Add Encryption keys and Create Encryption Keys. Otherwise, accept the defaults. For a highly secure environment, turn off all options; but note that this will make even simple housekeeping tasks, like changing the user password, a real burden.

22. After the settings are configured and the key is assigned a name, DESLock will generate a seed for a secret key pair. At this stage, you may choose between 3DES, Blowfish, or AES. The last is the newest algorithm, although for most security environments the choice will be largely meaningless unless interoperability with an existing PKI infrastructure is required. AES is the default.

23. DESLock will now load the key onto the USB device and the PC's database. To finish activating the key, double-click the D logo in the tray, then enter a user password. This, combined with the key, will grant access to any encryption-protected folders and files. A DESLock DK5 USB encryption token can hold up to 64 keys.

24. With DESLock installed, users can now right-click files or folders and select DESLock/Encrypt File with DESLock. But unlike NTFS encryption, DESLock requires that the USB decryption token be inserted and verified before a user can access these files. So, to protect large amounts of user data, let's create an encrypted partition.

First, right-click the DESLock logo. Then select Mount Manager. This creates a "filemount disk," a large encrypted file that acts as a virtual drive. Click Create to begin. Then select a location for the large file disk; it can be anywhere that is not in an already compressed or encrypted NTFS folder, and it will ideally be limited to 2 GB. This mounted disk will automatically carry the PKI encryption. Moving a large filedisk in this way can be an efficient method for transferring large volumes of encrypted data in a single package that still honors the PKI system -- unlike, say, a password-protected Zip file.

25. Time for the final housekeeping steps. Enter the Desktop properties by right-clicking the desktop, then selecting Properties, then going to the Screen Saver tab. Ensure that "On resume, display Welcome screen" is turned on, and reduce the screensaver timeout to just a few minutes. This will ensure that the user password is requested to resume normal operations. It will also protect the computer against unauthorized logins when the user leaves the computer unattended.

The final step is advocacy. Remind users of the importance of keeping the software on their client desktops simple. Particularly important is avoiding any server software, such as HTTP and FTP servers, as well as desktop-sharing servers. Such software turns a desktop system into a target. By preventing the spread of server software on desktops, we can all keep PCs cleaner, longer.

   Printer Friendly - This link will open in a new window.

Installing a Desktop Power Supply

Page 1 of 3

This guide was developed to instruct readers on the proper procedures for installing a power supply unit (PSU) into a desktop computer case. It includes step-by-step instructions with photographs for the physical installation of the PSU into a computer case.

IMPORTANT: Many name brand manufacturer PCs use specially designed power supplies that have been built specifically for their systems. As a result, it is generally not possible to buy a replacement power supply and install it into these systems. If your power supply is having problems, you will likely need to contact the manufacturer for repairs.

CAUTION: All power supplies contain various capacitors inside of them that retain power even after the power supply had all power turned off.

Aligning the Power Supply

Align the new PSU into place in the case so that the 4 mounting holes align properly. Make sure that any air intake fan on the power supply that resides in the case is facing towards the center of the case and not towards the case cover.

Page 2 of 3

Fasten the Power Supply

Now comes one of the most difficult portions of the power supply installation. The power supply needs to be held in place while it is fastened to the case with screws. If the case has a shelf ledge that the power supply sits on, it will be easier to balance.

Set the Voltage Switch

Make sure that the voltage switch on the back of the power supply is set to the proper voltage level for your country. North America and Japan use 110/115v, while Europe and many other countriesuse 220/230v. In most cases the switch will come preset to the voltage settings for your region.

Plug the Power Supply to the Motherboard

If the computer already has the motherboard installed into it, the power leads from the power supply need to be plugged in. Most modern motherboard use the large ATX power connector that gets plugged into the socket on the motherboard. Some motherboards require an additional amount of power through a 4-pin ATX12V connector. Plug this in if required.

Page 3 of 3

Connect Power to Devices

A number of items reside within a computer case that require power from the power supply. The most common device is the various hard drives and CD/DVD drives. Typically these use the 4-pin molex style connector. Locate the appropriate sized power leads and plug them into any devices that require power.

Close the Computer Case

At this point all of the installation and wiring should be completed with the power supply. Replace the computer cover or panel to the case. Fasten the cover or panel with the screws that were previously removed to open the case.

Plug in the Power and Turn on the System

Now all that is left is to provide the power to the computer. Plug in the AC cord to the power supply and turn the switch on the power supply to the ON position. The computer system should have available power and can be powered on. If you are replacing an older or damaged power supply, the steps to remove the power supply are identical to installing them but in the reverse order.

   Printer Friendly - This link will open in a new window.

Fitting an ATX Motherboard

Page 1 of 4

This guide was developed to instruct users on the proper installation of a motherboard into a computer case.
It includes step-by-step instructions for properly preparing the case, installing and connecting and necessary wires to the motherboard inside of the case. The guide is based upon a standard ATX board layout being installed into a mid-sized tower case. The case happens to have a removable motherboard tray to make it easier to photograph the necessary steps.

The amount of time and ease of the motherboard installation will be very dependent upon the design of the case it is being installed into.

All modern ATX motherboard have a variety of connectors and jumpers that must be set for proper operation of the computer system.
The location and pin layout of these will vary from case and motherboards. It is recommended that you fully read and have available all motherboard and case instructions which should include pin and jumper layouts.
The first step will be to open the case up. The method for opening the case will vary depending upon how the case was manufactured. Most new cases have either a side panel or door while older ones require the whole cover be removed. Remove any screws hold the cover to the case and set them aside in a safe place.

(Optional) Remove the Motherboard Tray
Some cases have a removable motherboard tray that slides out of the case to make it easier to install a motherboard. If your case has such a tray, now is the time to remove it from the case.

Page 2 of 4

Replace the ATX Connector Plate
While there is a standard ATX connector design for the back of the motherboard, each manufacturer can layout the connectors however they need to. This means that the basic ATX connector face plate will need to be removed from the case and the custom one that ships with the motherboard be installed.

To remove the basic ATX plate, gently press in on the corner of the installed ATX plate until it pops out. Repeat this on the opposite corner to fully remove the plate.

Install the new ATX place by aligning the connectors properly (PS/2 keyboard and mouse should be on the side towards the power supply) and gently pressing from the inside until it snaps into place.

Determine Motherboard Mounting Location
There are a variety of sizes that a desktop motherboard can come in. In each case, there is a series of mounting holes that need to be lined up between the motherboard and the case or tray. Compare the motherboard to the tray that it is going to be installed in. Any location that has a mounting hole will require a standoff installed in the tray.

Install the Motherboard Standoffs
Install the standoffs in the appropriate location. The standoffs may come a variety of styles. The most common is the brass hex standoff that requires a hex driver to install. Others include a clip style that snaps into the tray.

Page 3 of 4

Fasten the Motherboard
Lay the motherboard over the tray and align the board so all the standoffs are visible through the mounting holes. Starting with the center most mounting point, insert the screws to fix the motherboard to the tray. After the center, work in a star pattern to affix the corners of the board.

Attach ATX Control Wires
Locate the power, hard drive LED, reset and speaker connectors from the case. Using the manual from the motherboard, attach these connectors to the appropriate headers on the motherboard.

Connect the ATX Power Connecor
Now the motherboard needs to be connected to the power supply. All motherboards will use the standard 20-pin ATX power connector block. Find this and plug it into the connector on the motherboard. Since most new computers require additional power, there may also be a 4-pin ATX12V power connector. If there is, locate this power cord and connect it into the connector on the motherboard as well.

Page 4 of 4

(Optional)Replace the Motherboard Tray
If the case uses a motherboard tray and the previously removed from the case, it is now time to slide the tray back into the case to finish off the rest of the installation.

(Optional)Install Any Port Headers
Many motherboards today have a variety of additional connectors for different types of ports that do not fit on the motherboards ATX connector plate. TO handle these, they supply additional headers that connect to the motherboard and reside in a card slot cover. Additionally, some of these connectors may reside on the case and can be connected into the motherboard.

The installation of any header is very similar to that of installing a standard interface card. Please refer to the Installing a PCI Card guide for information on how to do this.

Once the header has been installed into a card slot, this and any case port connectors need to be attached to the motherboard. Please consult the motherboard manual for the appropriate location of the connectors on pin layouts on the motherboard for these cables.

It is still necessary at this point to install the remaining adapter cards and drives to the motherboard in order to complete the system installation.

It is important that once the system is up and running to verify that all the connectors, jumpers and switches are properly installed. If any of them are not work, power down the system and refer to the instruction manual to see if the connectors may be improperly installed.

   Printer Friendly - This link will open in a new window.

Fitting an ATA Hard Drive

Page 1 of 3

This guide was developed to instruct readers on the proper procedures for installing a Serial ATA hard drive into a desktop computer system. It includes step-by-step instructions for the physical installation of the drive into the computer case and properly connecting it into the computer motherboard. Please refer to the documentation included with the hard drive for some of the items listed in this guide.

Before working on the inside of any computer system, it is important to power down the computer. Shutdown the computer from the operating system. Once the system has safely shutdown, turn off the power to the internal component by flipping the switch on the back of the computer and removing the AC power cord.

Opening up the computer case will vary depending upon how the case was manufactured. Most new cases will use either a side panel or door while older models require the whole cover be removed. Remove any screws used to fasten the cover to the case and set them aside in a safe place.

Page 2 of 3

Install the Hard Drive to the Drive Cage

Most computer system use a standard drive cage to install a hard drive but some newer cases use a form of tray or rails. Here are the instructions for the two most common methods:

Drive Cage: Simply slide the drive into the cage so that the mouting holes on the drive line up with the holes in the drive cage. Fasten the drive to the cage with screws.

Tray or Rails: Remove the tray or rails from the system and align the tray or rails to match the mounting holes on the drive. Fasten the drive to the tray or rails using screws. Once the draive is affixed, slide the tray or drive into the appropriate slot until it is secure.

Plug the Serial ATA Cable to the Motherboard

Connect the Serial ATA cable to the Primary or Secondary Serial ATA connector on the motherboard or PCI card. The drive can be plugged into either although if the drive is meant to be used as a boot drive, select the primary channel as this is the first drive to boot between the Serial ATA connectors.

Plug the Serial ATA Cable to the Drive

Attach the other end of the Serial ATA cable to the hard drive. Note that the serial ATA cable is keyed so that it can only be plugged in one way to the drive.

Page 3 of 3

(Optional) Plug in Serial ATA Power Adapater

Depending on the drive's power connectors and the power supply it may be necessary to use a 4-pin to SATA power adapter. If one is required, plug the adapter into the 4-pin Molex power connector from the power supply. Most new power supplies will come with a couple Serial ATA power connectors directly off the power supply.

Plug the Power to the Drive

Attach the Serial ATA power connector to the connector on the hard drive. Note that the Serial ATA power connector is larger than the data cable connector.

Close the Computer Case

At this point, all of the interior work for the hard drive is completed. Replace the computer panel or cover to the case and fasten it with the screws that were previously removed when opening the computer case.

Power Up the Computer

All that is left to do now is power up the computer. Plug the AC power cord back into the computer system and flip the switch on the back to the ON position.

Once these steps are taken, the hard drive should be physically installed into the computer for proper operation. The drive must be formatted for use with the operating system before it can be used. Please consult the documentation that came with your motherboard or computer for additional information.

   Printer Friendly - This link will open in a new window.

Fitting a PCI Card

Page 1 of 3

This guide was developed to instruct users on the proper method for installing a PCI adapter card into a desktop computer system. It is a step-by-step instruction guide with photographs detailing the individual steps. Since there are a wide variety of PCI adapters that can be installed inside of a computer system, it will only show the physical installation of the card. Peripheral attachment either through internal or external connections should be done by referring to the installation directions that come included with the adapter card.

Before beginning any work on the inside of a computer system, it is important to make sure there is no power. Shutdown the computer from the operating system.

Once the computer has safely shut down, flip the switch on the back of the power supply and remove the AC power cord.

Opening Up the Computer

The method for opening of the computer case will vary depending upon how it was manufactured. Most new cases will use either a side panel or door while older one require that the whole cover be removed. Remove any screws that fasten the cover to the case and set them aside in a safe place.

Page 2 of 3

Remove PC Card Slot Cover

Determine which slot inside of the computer the PCI card will be installed in. Based on this slot, remove the slot cover from the case. Most cases will have an internal slot cover that needs to be unscrewed from the case. Some new cases use covers that simply snap into the slot.

Insert the PCI Card

Position the PCI card in the slot directly over the connector and gently push down on both sides of the card until it slides into the PCI connector.

Fasten the PCI Card to the Case

Fasten the PCI card to the computer case with a screw in the slot cover. Some new cases may use a tool free connector that snaps into place over the card cover to hold the card in place.

Page 3 of 3

Attach Any Cables

Most PCI cards are being installed into the computer to connect some peripheral to the computer system. This means that one or more cables will need to be attached between the PCI card and the peripheral. Attach any internal or external cables at this point.

Close the Computer Case

At this point, all the internal installation work is completed and the computer case can be closed up. Return the panel or cover to the case and fasten it with the screws that were previously removed.

Power Up the Computer

Plug the AC power cord back into the computer and flip the switch on the back to the ON position. At this point, the card is physically installed into the computer system. It is still necessary for the system to be powered on and the hardware detected. Once the system has detected the hardware, it should request any necessary software drivers for its proper operation. Please refer to the documentation that came with the adapter card for the proper software installation procedure.

   Printer Friendly - This link will open in a new window.