1

Having read in Set a Blank Password in Windows XP To Protect the Computer from Internet Attacks :

"Using a blank password (or no password at all) makes your computer more secure because Windows XP accounts, that are not protected by a password, cannot be accessed remotely over the network or the Internet.

You have to be physically infront of the computer in order to get in. Due to this default behavior, it is better to leave a blank password assigned to an XP account rather than assigning a weak, easily guessed password"

I'd like to understand:
How can I reproduce exactly the same protection but with non-blank password?

4
  • 2
    Disable the remote services. as for the other stuff, there would be a lot more to analise before believing that wouldnt have more ramifications beyond what is stated, and vulnerabilities (patched or not) were not limited.
    – Psycogeek
    Apr 25, 2012 at 5:50
  • I want to disable remote access to my computer not remote services most of which are required for computer functioning if not to mention programming or from my computer to remote and local services Apr 25, 2012 at 10:34
  • Remote services, and many other holes in the system, are closed when the services that are activly waiting for a connection are stopped. The claimed idea behind not having a proper password, is to disable the ability to use those services from the outside. If the intent is to stop those connections, I see no point in leaving them waiting to connect.
    – Psycogeek
    Apr 26, 2012 at 0:54
  • I am developer and routinely use IIS, MSSQL, network-shared resources to access for testing and developing it locally without a minimal intention of using or even being visible it outside of my computer. Most local processes are used and configured as remote inside the same computer Apr 30, 2012 at 5:42

1 Answer 1

3

Deny your account remote access in Local Security Settings (secpol.msc) under Local Policies → User Rights Assignment. (This can also be modified via group policy.)

The policies to change are:

  • "Deny access to this computer from the network" (for network logins such as file sharing)

  • "Deny log on through Terminal Services" (for interactive logins using Remote Desktop)

  • "Deny log on as a batch job" (for batch logins using Scheduled Tasks)


You cannot disallow usage of such tools as runas for specific accounts, only disable this functionality system-wide (by disabling the "Secondary Logon" service, which may break some Windows features). However, this is not a problem in your case, since the attacker cannot use runas without already having broken in to another account.

But note that Windows has a history of vulnerabilities in all of its network services that would allow bypassing authentication entirely, in some way or other. It is best to not expose SMB or Remote Desktop to the Internet at all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .