9

Hi I am going on vacation. I wanna secure my PC. Is there any way I can lock down my PC so that nobody can boot up it? Any BIOS level security?

BTW. I am running Windows 7 Ultimate.

2
  • 3
    If someone wants your data, they will remove the HD and plug it in their computer. Options are to encrypt the drive, or to physically remove it yourself, like all the other posts have mentioned. Dec 15, 2010 at 5:40
  • 1
    If this is just to prevent someone at home from hacking your machine, then just unplug the power supply from the motherboard and lock the chassis. Nobody will be able to turn it on without obviously damaging the chassis, and it may be enough to deter a nosey person. Mar 8, 2011 at 14:51

4 Answers 4

14

The most secure: Take the hard drive out and put it somewhere safe.

Next best: Most BIOSes have security options for requiring passwords to boot up.

3
  • 10
    However, the BIOS password is trivial to reset if someone can open the PC case (at least in most desktop PCs; some notebooks have much better security, which results in expensive service if the BIOS password is forgotten). Dec 14, 2010 at 20:52
  • Make sure you have a good backup before doing anything with the hard disk that increases the risk of it being dropped, lost or zapped by static electricity. Why not just leave the PC with a trusted friend or lock it in a cupboard? Worse case, take it to a mailbox company or left luggage place and stow it.
    – Linker3000
    Dec 14, 2010 at 21:06
  • 2
    +1 for 'just take the hard drive and lock it up someplace'.
    – Shinrai
    Dec 14, 2010 at 23:38
7

Physical access trumps most preventative measures you may put in place on your system, if the attacker knows what they're doing. There's a few options for preventing unauthorized boot-up of your system and access to your data. The following may be performed individually, or all together.

  • Set a BIOS password.
    • Typically this requires a key to be pressed the minute the system boots, just before you see the Windows loading screen. Common keys used for this are: DEL, F2, F12, F10, ESC.
    • Consult your PC or motherboard manufacturers' websites for more detailed and thorough instructions. The BIOS is separate from the OS, and methods of access vary widely between hardware manufacturers.
    • This method will render the system unbootable, even from a boot CD or another hard drive, without the password.
    • However, this is in most cases easily bypassed by physical means such as shorting a jumper on the motherboard. If possible, you may wish to physically lock the PC case to prevent this - but physical locks can be broken.
  • Encrypt the hard drive.
    • Download TrueCrypt (http://truecrypt.org/) and follow instructions on the website for Whole Disk Encryption on a System Disk.
    • This method will render the system unbootable from your hard drive, without the decryption key. It will also protect that drive's data from being read if it is stolen, or if the system is booted from a CD or separate hard drive.
  • Take your hard drive with you.
    • If you choose this option, keep it wrapped in an anti-static bag, within a well-padded container. And of course, don't let it wander near any magnets.
    • Someone could still boot your system from a boot disk, or install a different hard drive, but they will not have access to your data.
    • If your drive is not encrypted, loss or theft of the drive while away from home will result in full compromise of any personal information stored within it.
3
  • 2
    I'd wager that the chances of you losing/dropping/bashing your hard drive/luggage are far higher than some burglar breaking into your house whilst you're away and booting up your PC. +1 for encryption and bios password though.
    – RJFalconer
    Dec 14, 2010 at 23:41
  • 1
    Instead of taking the drive on the road, consider simply hiding it in a closet or a drawer. If the computer does happen to get stolen, the drive might still be around. Alternatively, if you have a safe, use that.
    – JYelton
    Dec 15, 2010 at 0:04
  • 1
    @RJFalconer - I'd wager the OP is more concerned about insider threats (i.e.: kids that are supposed to be grounded, nosy roommates, etc.) than burglars.
    – Iszi
    Dec 15, 2010 at 1:12
3

Setup full disk encryption using something like Truecrypt. http://www.truecrypt.org/ With a strong password your data will be very safe from other people. They can destroy it, to prevent loss, make a backup, and store it somewhere else, also encrypted.

2

If your BIOS supports it you can set a boot password. You can also turn on user account passwords by running control userpasswords2 from the start bar and setting up the accounts appropriately.

4
  • How will i come to know if BIOS supports? I have windows 7 Ultimate running on i7
    – learner
    Dec 14, 2010 at 20:50
  • When you reboot your computer you will have to follow its on-screen instructions to setup the BIOS.
    – Mike Chess
    Dec 14, 2010 at 21:20
  • 3
    @learner - 99.999999% of BIOSes support boot passwords. It's just a matter of knowing how to do it. For this, we would need the PC make/model and/or motherboard make/model. The BIOS is separate from the OS.
    – Iszi
    Dec 14, 2010 at 22:14
  • Adding passwords to user accounts in Windows is only marginally secure. Unless you encrypt the files on disk, simply removing the drive and accessing it with a different computer is enough to bypass Windows user passwords (not to mention a plethora of utilities designed to circumvent NTLM passwords).
    – JYelton
    Dec 15, 2010 at 0:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .