up vote 9 down vote favorite
1
share [g+] share [fb]

Hi I am going on vacation. I wanna secure my PC. Is there any way I can lock down my PC so that nobody can boot up it? Any BIOS level security?

BTW. I am running Windows 7 Ultimate.

link|improve this question
25% accept rate
3  
If someone wants your data, they will remove the HD and plug it in their computer. Options are to encrypt the drive, or to physically remove it yourself, like all the other posts have mentioned. – ja72 Dec 15 '10 at 5:40
1  
If this is just to prevent someone at home from hacking your machine, then just unplug the power supply from the motherboard and lock the chassis. Nobody will be able to turn it on without obviously damaging the chassis, and it may be enough to deter a nosey person. – Johnny W Mar 8 '11 at 14:51
feedback

migrated from serverfault.com Dec 14 '10 at 20:54

This question came from our site for system administrators and desktop support professionals.

4 Answers

up vote 13 down vote

The most secure: Take the hard drive out and put it somewhere safe.

Next best: Most BIOSes have security options for requiring passwords to boot up.

link|improve this answer
9  
However, the BIOS password is trivial to reset if someone can open the PC case (at least in most desktop PCs; some notebooks have much better security, which results in expensive service if the BIOS password is forgotten). – Sergey Vlasov Dec 14 '10 at 20:52
Make sure you have a good backup before doing anything with the hard disk that increases the risk of it being dropped, lost or zapped by static electricity. Why not just leave the PC with a trusted friend or lock it in a cupboard? Worse case, take it to a mailbox company or left luggage place and stow it. – Linker3000 Dec 14 '10 at 21:06
2  
+1 for 'just take the hard drive and lock it up someplace'. – Shinrai Dec 14 '10 at 23:38
feedback
up vote 7 down vote

Physical access trumps most preventative measures you may put in place on your system, if the attacker knows what they're doing. There's a few options for preventing unauthorized boot-up of your system and access to your data. The following may be performed individually, or all together.

  • Set a BIOS password.
    • Typically this requires a key to be pressed the minute the system boots, just before you see the Windows loading screen. Common keys used for this are: DEL, F2, F12, F10, ESC.
    • Consult your PC or motherboard manufacturers' websites for more detailed and thorough instructions. The BIOS is separate from the OS, and methods of access vary widely between hardware manufacturers.
    • This method will render the system unbootable, even from a boot CD or another hard drive, without the password.
    • However, this is in most cases easily bypassed by physical means such as shorting a jumper on the motherboard. If possible, you may wish to physically lock the PC case to prevent this - but physical locks can be broken.
  • Encrypt the hard drive.
    • Download TrueCrypt (http://truecrypt.org/) and follow instructions on the website for Whole Disk Encryption on a System Disk.
    • This method will render the system unbootable from your hard drive, without the decryption key. It will also protect that drive's data from being read if it is stolen, or if the system is booted from a CD or separate hard drive.
  • Take your hard drive with you.
    • If you choose this option, keep it wrapped in an anti-static bag, within a well-padded container. And of course, don't let it wander near any magnets.
    • Someone could still boot your system from a boot disk, or install a different hard drive, but they will not have access to your data.
    • If your drive is not encrypted, loss or theft of the drive while away from home will result in full compromise of any personal information stored within it.
link|improve this answer
2  
I'd wager that the chances of you losing/dropping/bashing your hard drive/luggage are far higher than some burglar breaking into your house whilst you're away and booting up your PC. +1 for encryption and bios password though. – RJFalconer Dec 14 '10 at 23:41
1  
Instead of taking the drive on the road, consider simply hiding it in a closet or a drawer. If the computer does happen to get stolen, the drive might still be around. Alternatively, if you have a safe, use that. – JYelton Dec 15 '10 at 0:04
1  
@RJFalconer - I'd wager the OP is more concerned about insider threats (i.e.: kids that are supposed to be grounded, nosy roommates, etc.) than burglars. – Iszi Rory or Isznti Dec 15 '10 at 1:12
+1 Excellent answer. – Johnny W Mar 8 '11 at 14:48
feedback
up vote 3 down vote

Setup full disk encryption using something like Truecrypt. http://www.truecrypt.org/ With a strong password your data will be very safe from other people. They can destroy it, to prevent loss, make a backup, and store it somewhere else, also encrypted.

link|improve this answer
feedback
up vote 2 down vote

If your BIOS supports it you can set a boot password. You can also turn on user account passwords by running control userpasswords2 from the start bar and setting up the accounts appropriately.

link|improve this answer
How will i come to know if BIOS supports? I have windows 7 Ultimate running on i7 – learner Dec 14 '10 at 20:50
When you reboot your computer you will have to follow its on-screen instructions to setup the BIOS. – Mike Chess Dec 14 '10 at 21:20
3  
@learner - 99.999999% of BIOSes support boot passwords. It's just a matter of knowing how to do it. For this, we would need the PC make/model and/or motherboard make/model. The BIOS is separate from the OS. – Iszi Rory or Isznti Dec 14 '10 at 22:14
Adding passwords to user accounts in Windows is only marginally secure. Unless you encrypt the files on disk, simply removing the drive and accessing it with a different computer is enough to bypass Windows user passwords (not to mention a plethora of utilities designed to circumvent NTLM passwords). – JYelton Dec 15 '10 at 0:06
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.