Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Having read in Set a Blank Password in Windows XP To Protect the Computer from Internet Attacks :

"Using a blank password (or no password at all) makes your computer more secure because Windows XP accounts, that are not protected by a password, cannot be accessed remotely over the network or the Internet.

You have to be physically infront of the computer in order to get in. Due to this default behavior, it is better to leave a blank password assigned to an XP account rather than assigning a weak, easily guessed password"

I'd like to understand:
How can I reproduce exactly the same protection but with non-blank password?

share|improve this question
2  
Disable the remote services. as for the other stuff, there would be a lot more to analise before believing that wouldnt have more ramifications beyond what is stated, and vulnerabilities (patched or not) were not limited. –  Psycogeek Apr 25 '12 at 5:50
    
I want to disable remote access to my computer not remote services most of which are required for computer functioning if not to mention programming or from my computer to remote and local services –  Gennady Vanin Novosibirsk Apr 25 '12 at 10:34
    
Remote services, and many other holes in the system, are closed when the services that are activly waiting for a connection are stopped. The claimed idea behind not having a proper password, is to disable the ability to use those services from the outside. If the intent is to stop those connections, I see no point in leaving them waiting to connect. –  Psycogeek Apr 26 '12 at 0:54
    
I am developer and routinely use IIS, MSSQL, network-shared resources to access for testing and developing it locally without a minimal intention of using or even being visible it outside of my computer. Most local processes are used and configured as remote inside the same computer –  Gennady Vanin Novosibirsk Apr 30 '12 at 5:42
add comment

1 Answer

up vote 3 down vote accepted

Deny your account remote access in Local Security Settings (secpol.msc) under Local Policies → User Rights Assignment. (This can also be modified via group policy.)

The policies to change are:

  • "Deny access to this computer from the network" (for network logins such as file sharing)

  • "Deny log on through Terminal Services" (for interactive logins using Remote Desktop)

  • "Deny log on as a batch job" (for batch logins using Scheduled Tasks)


You cannot disallow usage of such tools as runas for specific accounts, only disable this functionality system-wide (by disabling the "Secondary Logon" service, which may break some Windows features). However, this is not a problem in your case, since the attacker cannot use runas without already having broken in to another account.

But note that Windows has a history of vulnerabilities in all of its network services that would allow bypassing authentication entirely, in some way or other. It is best to not expose SMB or Remote Desktop to the Internet at all.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.