what's the best way to lock down a computer?

[nageov3t]

so, I'm building a new computer for my mom for christmas (the OS is actually installing right now as I surf the net on my laptop)... WinXP x64 and much more horsepower under the hood than she actually needs.

my big concern is locking down the computer so I don't get phone calls about spyware once/week... bearing in mind that 5+ years of telling her not to open email attachments ever and don't click a link unless you know what it is haven't done the trick, what can I do? FF + noscripts probably isn't the ideal solution as then she'll just be calling me every night trying to figure out why certain elements of some webpages she visits aren't working.

also, what's the best free anti-virus out there right now? I thought I remembered a big freeware thread in this forum, but I can't seem to find it anymore.

 

[lxskllr]

Linux if you think she can use it(doesn't need a bunch of proprietary apps). Otherwise, a limited user account(Vista or Win7 would be better). I like Antivir, but MSE would be alright too. I also install Spywareblaster, and SpyBot S&D. I use logmein for my mother's machine, and update non Windows components on a regular basis.

Edit:
Check out the security sticky...

http://forums.anandtech.com/showthread.php?t=98805

Especially the links from Mechbegon

 

[GeekDrew]

Why on earth are you installing WinXP x64 (BTW, Office 2010 will not support WinXP x64)?!? I'd recommend a Win7 regular user account (non-admin) to protect the system. She still might call - there's no way to prevent that - but it should cut down on the serious problems.

 

[nageov3t]

Why on earth are you installing WinXP x64 (BTW, Office 2010 will not support WinXP x64)?!? I'd recommend a Win7 regular user account (non-admin) to protect the system. She still might call - there's no way to prevent that - but it should cut down on the serious problems.

because I have an unused copy of XP sitting around doing nothing also, it's the only OS she's ever used... I hate introducing change into her computing life. lol.

 

[corkyg]

I highly recommend Microsoft Security Essentials for AV and AM.

 

[snikt]

Among other options we use to lock down PCs that are accessible to the public here at work, we use SteadyState from M$. Its free, go figure, but it very easy to manage and has worked like a charm.

 

[mechBgon]

SteadyState won't work on WinXP x64, though. It's for 32-bit only.

Here's my suggestions: http://www.mechbgon.com/security and especially note the Software Restriction Policy at the end. That'll work on WinXP x64 since it's Professional Edition, and combined with a Limited account, it's super-powerful. It's also permanently free, doesn't need updates, and doesn't have a noticable performance impact.

 

[VirtualLarry]

I highly recommend Microsoft Security Essentials for AV and AM.

For Xp 64-bit??? Is that really supported?

 

[VirtualLarry]

SteadyState won't work on WinXP x64, though. It's for 32-bit only.

Here's my suggestions: http://www.mechbgon.com/security and especially note the Software Restriction Policy at the end. That'll work on WinXP x64 since it's Professional Edition, and combined with a Limited account, it's super-powerful. It's also permanently free, doesn't need updates, and doesn't have a noticable performance impact.

I second this. I set up SRP on all of my friend's machines, and that has cut down on the drive-by malware trojan download + execution like you wouldn't believe.

My friend did an AV scan, and found like 8 trojans. They had downloaded in the background using IE, but never got a chance to execute, because of SRP silently killing them.

It works! Use it!

 

[corkyg]

For Xp 64-bit??? Is that really supported?

My bad! It would have to be Win 7 64 bit or XP 32 bit. 64 bit XP is somewhat of a problem in many ways.