Securing Mobile Computers with Windows XP Professional

Published: October 01, 2001 | Updated: February 17, 2003

By Nick George
Microsoft Corporation
Abstract

This article examines specific threats that can affect mobile computers—also known as laptop or notebook computers. It also covers how the security tools and privacy services included in the Microsoft® Windows® XP Professional operating system provide solutions to combat these threats.

On This Page

Acknowledgements
Introduction
Understanding Security Threats to Mobile Computers
Security Technologies in Windows XP
Summary
Related Links

Acknowledgements

David Cross, Windows Security Program Manager, Microsoft Corporation

Jason Garms, Windows Security Program Manager, Microsoft Corporation

Praerit Garg, Windows Security Lead Program Manager, Microsoft Corporation

Jason Anderson, Consumer Platform Technical Evangelist, Microsoft Corporation

Michael Kessler, Technical Editor, Microsoft Corporation

Introduction

This article examines specific security threats applicable to mobile computers—also known as laptop or notebook computers, along with the security tools and privacy services included in the Microsoft® Windows® XP Professional operating system that provide solutions to combat these threats.

Only a few of the security benefits identified in this article are available to non-domain-connected computers; where applicable these benefits will be identified.

Organizations are reevaluating their internal controls and are making the protection of mobile computing a top priority, as discussed in the ZDNet article, Wolves at the Door. Microsoft Windows XP addresses this security imperative with a range of features designed to provide strong security while preserving the flexibility and power that information security managers have come to expect from an enterprise operating system. If you're an information security manager, you can also customize Windows Server 2003, including the deployment of Group Policies, to provide a secure working environment.

For a great overview article describing the new security features and policies available in Windows XP, read the article What's New in Security for Windows XP Professional and Windows XP Home Edition—many of the security topics included in that article are presented here in the context of mobile computing security.

Understanding Security Threats to Mobile Computers

This section catalogs the security threats to mobile computers and identifies ways that Windows XP deals with these threats.

Whenever a mobile computer is outside the enterprise's physical security boundary, theft of the computing device and the data it contains is a primary concern. If theft does occur, the initial data loss problem escalates to potentially having an unauthorized person penetrate the network via remote dial-up or wireless networking.

Warning: The mobile computer is subject to all typical computer security threats.

Data Loss and Theft

Data loss may not seem like a security threat, but it is, as illustrated by the Third Immutable Law of Security from the Microsoft TechNet article which states: "If a bad guy has unrestricted physical access to your computer, it's not your computer anymore."

By design, mobile computers and many new types of portable devices have a higher risk of being stolen than a non-portable device. Often these machines hold important company data and represent a security risk if stolen; this point is illustrated in a Computerworld article outlining the security lessons learned when the chairman of a large telecommunications firm had his laptop computer stolen.

Protecting Against Data Loss

The Encrypting File System (EFS) in Windows XP Professional enables you to protect yourself against the loss of stolen data. This security feature obscures data on the hard drive and renders it useless to anyone without proper credentials.

Windows XP also incorporates Intellimirror® technology and supports redirection of the My Documents folder, whereby a user's data is stored centrally. EFS, coupled with the capability to locally cache your network-based files and folders, provides the highest level of security, full-time access to data, and the convenience of centralized network file backup.

Note: EFS, offline folders and file caching are features of Windows XP Professional, and are not included in Windows XP Home Edition.

Network Penetration

Network penetration is a serious security threat that can occur as a result of information gleaned from a stolen or non-secure mobile device. Many network penetrations are committed by individuals using stolen mobile computers.

The following Windows XP features limit the risk of network penetration:

• Access control management curtails the anonymous access associated with the Internet.

• Simple Sharing limits access to only those network resources provided to guest accounts.

• Force Guest restricts access to unauthenticated user accounts within a domain.

• Automatic smart card enrollment and self-registration authority provide enhanced security for enterprise users by adding another layer of authentication.

• Credential Manager enables stored or cached user credentials to be encrypted so that only authenticated users have access to stored credentials.

• Internet Connection Firewall (ICF) provides baseline intrusion prevention functionality to computers running the Windows XP operating system. It's designed for computers directly connected to a public network as well as computers that are part of a home network when used with Internet Connection Sharing

Eavesdropping on Wired and Wireless Sessions

Another way the security of your business and personal data can be compromised is through network sniffing or "eavesdropping".

Remote computing, in both wired and wireless networking scenarios, is becoming a common part of business life—along with the security risks associated with this practice. By default, e-mail headers and content are transmitted in clear text, and if no encryption is used, the content of a message can be read or altered in transit. In another example, a header can be modified to hide or change the identity of the sender, or to redirect the message. As a result, security using wired and wireless networks is becoming more and more crucial as companies continue to use public infrastructure to transport company data.

Enterprise Security Management Issues

There's a growing interest in using the IEEE 802.11 networking protocol as an enterprise-deployable technology; but enterprise security management issues still remain. These issues include:

• Open and visible service set identifiers (SSID) are an inherently weak security mechanism.

• Wired Equivalent Privacy (WEP) key attacks are theoretically possible using publicly available tools.

• IEEE 802.11 WEP key management is lacking a protocol for distribution of keys.

• Lack of authentication and encryption services in a wireless 802.11 ad hoc network mode raises security concerns when users engage in peer-to-peer collaborative communication in areas such as conference rooms.

Protecting Remote Computing Sessions

Windows XP limits the risk of having remote computing sessions intercepted in the following ways:

• Protects communication over the Internet using virtual private networks (VPN) and integrated tunneling and encryption technologies. These technologies include: Internet protocol security (IPSec); Layer 2 tunneling protocol (L2TP); public key infrastructure (PKI); and Point-to-point tunneling protocol (PPTP).

• Provides for zero configuration networking and roaming enhancements to make transitioning between wireless networks easy.

• Supports the IEEE 802.1X protocol to make it easier to manage wireless devices, control the flow of data through wireless access points, and periodically challenge and re-authenticate the wireless stations attached to those wireless network access points.

• Supports WEP, the first-generation IEEE 802.11 wireless access session security protocol. (Enterprise networks should be configured with IEEE 802.1X to control wireless sniffing threats against IEEE 802.11 network configurations).

• Provides callback access support, a mobile network access technology that instructs a remote access server to disconnect, and then call you back after you dial-in.

• Supports remote access and VPN—including support for credential keyring

Note: For more information about wireless network configuration, and security issues related to the IEEE 802.11 protocol, see read Wireless LAN Technologies and Windows XP.

Password Cracking

Many network penetrations are committed either by individuals using stolen mobile computers, or by unauthorized users having access to an authorized user's machine. Typically, mobile computers that are part of a domain are more secure because domain members' credentials are centrally stored, and can only be changed at a domain controller, which, if best practices have been followed, will be the most heavily-defended machine in a network.

Protecting Credentials

Remote computing dial-up applications that allow the end-user to cache their network access credentials aren't helping secure corporate networks—network security managers should implement password policies that enforce strong passwords, force password entry when resuming from system power management standby modes and screensavers, and prohibit the caching of remote access credentials.

Windows XP reduces the risk of exposing confidential data, such as passwords; Syskey encrypts the password hashes stored in the Security Account Manager (SAM)

Protecting Standalone Computers

Mobile computers that are not part of a managed domain are even more at risk as a result of the lack of enforceable security policies. By default, user accounts configured on a Windows XP computer that is not joined to the domain do not have passwords associated with them for convenience sake. While this is acceptable in a home desktop environment, small business and home mobile users need to take extra steps to ensure that accounts configured on these systems have strong passwords associated with them.

Exposure of Confidential Data

Virtually all corporate employees have some sensitive material on their computers that needs to be protected against improper disclosure. Through education and corporate policies, users should be encouraged to store sensitive documents on network servers. Where this policy is too restrictive, Windows XP Professional provides ways to reduce the risk of exposing confidential data.

Reducing the Risk of Exposure

Windows XP Professional reduces the risk of exposing confidential data in the following ways:

• NTFS and EFS scramble the contents of documents so that they're unreadable by unauthorized users.

• Controlled network access, including support for dial-up connections, limits exposure to authorized uses.

• Blank password restriction enforces basic security principles.

Protecting Standalone Computers

Users of mobile computers that are not part of a managed domain also store sensitive data on their machines. For these non-domain-connected machines NTFS and EFS, coupled with strong user passwords, is the best defense.

Security Technologies in Windows XP

This section focuses on Windows XP security technologies that support mobile computing—security technologies applicable exclusively to desktop computers are not covered.

Note: For a complete description of security technologies in Windows XP see What's New in Security for Windows XP Professional and Windows XP Home Edition.

If you are already familiar with the security model in Microsoft Windows NT® 4.0 and Microsoft Windows 2000, you will recognize many of the security features in Windows XP Professional. At the same time, you will also find a number of familiar features that have changed significantly, and new features that will improve your ability to manage system security.

Windows XP provides several methods for managing security. Knowledge of how Windows XP security features work provides a framework for understanding how to design and maintain a secure environment where mobile computers are part of a domain.

Mobile Computing Security Framework

Windows XP Professional includes a number of features that businesses can use to protect selected files, applications, and other resources on both desktop and mobile computers. These features include access control lists (ACL), security groups, and Group Policy—in addition to the tools that allow businesses to configure and manage these features. Together they provide a powerful, yet flexible, access control infrastructure for business networks.

Windows XP offers thousands of security-related settings that can be implemented individually. It also includes predefined security templates that can be used without modifications, or used as the basis for a more customized security configuration.

Using Security Templates

Businesses can apply security templates when they:

• Create a resource, such as a folder or file share, and either accept the default access control list settings or implement custom access control list settings.

• Place users in the standard security groups, such as Users, Power Users, and Administrators, and accept the default ACL settings that apply to those security groups.

• Use the Basic, Compatible, Secure, and Highly Secure Group Policy templates that have been provided with the operating system.

Settings and Tools

Each of the Windows XP security features—ACL, security groups, and Group Policy—have default settings that can be modified to suit a particular organization, and in particular the mobile computer. Businesses can also make use of relevant tools to implement and modify access control. Many of these tools, such as the Microsoft Management Console (MMC) snap-ins, are components of Windows XP Professional. Other tools are included with the Windows XP Professional Resource Kit.

Key Security Features for Mobile Computing

The following list outlines the Windows XP security features that support mobile computing. These security features are described in greater detail in the sections that follow.

• Group Policy Objects—smart card authentication

• Managing Network Authentication—Guest account used for internet logins

• Syskey encrypts the SAM database using strong encryption

• Mobile Network Access Technologies

  • Virtual Private Networking

  • 802.1X—encryption key management

  • Infrared Data Association (IrDA)—allows user control of access and file transfers

  • Point-to-point protocol over Ethernet (PPPoE) client

  • Callback

• Encrypting file system

  • EFS and NTFS

  • Encrypting offline files and the offline files database

• Certificate services

• Credential management (including stored passwords)

Note: Most Windows XP security features support both desktop and mobile computers. Those key foundational technologies are not described within this article. For a complete description of security technologies in Windows XP read What's New in Security for Windows XP Professional and Windows XP Home Edition.

Group Policy Objects and Smart Card Authentication

Windows XP Professional offers robust security features to help businesses protect sensitive data and provide support for managing users on the network. One of the great features available in Windows XP Professional is the use of Group Policy objects (GPO).

GPOs allow system administrators to apply a single security profile to multiple computers, and optionally use smart card technology to authenticate users with information stored on a smart card. Unfortunately, mobile computers typically do not include a smart card reader though most mobile computers can support smart card authentication. For Mobile computers without native smart card readers, support for smart cards can be provided by either a PCMCIA or USB-based Smart Card reader

Note: In order to use smart card authentication the computer must join a domain. Therefore smart cards cannot be used on a local workgroup machine.

Managing Network Authentication—Guest Account

An increasing number of Windows XP Professional mobile computers are connected directly to the Internet rather than to domains. This makes proper management of access control (including strong passwords and permissions associated with different accounts) more critical than ever. To ensure security, the relatively anonymous access control settings commonly associated with open Internet environments need to be curtailed.

As a result, the default in Windows XP Professional requires all users logging on over the network to use the Guest account. This change is designed to prevent hackers attempting to access a system across the Internet from logging on by using a local Administrator account that has no password.

Syskey Encrypts the SAM Database Using Strong Encryption

Syskey is a feature that was first introduced in Windows NT® 4.0 that makes it more difficult for an attacker to compromise user passwords on a Windows machine.

In Windows NT, Windows 2000 and Windows XP the hashed values for passwords are encrypted using the Syskey, and then stored in the SAM database. This slows down a brute-force password attack.

Thwarting a Brute-force Attack

Syskey effectively thwarts a brute-force password attack by encrypting the SAM database using strong encryption. Even if an attacker did manage to obtain a copy of the Syskey-protected SAM, he would first need to conduct a brute-force attack to determine the Syskey, and then conduct a brute-force attack against the hashes themselves. This dramatically increases the work factor associated with the attack, to the point where it's considered to be computationally infeasible. To learn more about this read the Microsoft TechNet article, Analysis of Alleged Vulnerability in Windows 2000 Syskey and the Encrypting File System.

Domains Are More Secure Than Workgroups

Mobile computers that are part of a domain are more secure than those in a workgroup. Domain members' credentials are centrally stored and can only be changed at a domain controller. If best practices for Encrypting File System have been followed, the domain controller will be the most heavily-defended machine in a network.

Mobile Network Access Technologies

Virtual Private Networking

VPNs allow you to rely on the Internet as a secure pipeline to your corporate LAN. If you are traveling, you can dial-in to almost any local Internet service provider (ISP), then set up a VPN session to connect to your corporate LAN over the Internet. With VPNs, companies can significantly reduce long-distance dial-up charges, and mobile employees have an inexpensive method of remaining connected to LANs for extended periods.

In addition to supporting today's most common VPN protocol, Point-to-Point Tunneling Protocol (PPTP), Windows XP Professional supports new, more secure ways of creating virtual connections. These include Layer-2 Tunneling Protocol (L2TP) and Internet Protocol Security (IPSec), which allow you to connect to corporate networks with confidence.

More information about PPTP, L2TP, and IPSec can be found in the Windows 2000 Technical Library at https://www.microsoft.com/technet/prodtechnol/windows2000serv/default.mspx.

802.1X—Encryption Key Management

Support for the 802.1x security standard in Windows XP lets you roam from access point to access point within your corporate LAN. You can also roam from hot spot to hot spot—for example, airport lounge to Internet café—and be identified and allowed access to those networks without additional logons.

Access is controlled per-user and/or per-port; this allows for precise access control and identification which allows a wide variety of services to be provided. And thanks to the security protocols used in the 802.1X standard, you can use your networks with a higher level of confidence in their security than even wired connections can offer.

IrDA

Windows XP Professional supports the Infrared Data Association (IrDA) protocol suite that lets you transfer information and share resources like printers between computers without using physical cables. Many mobile computers include hardware support for IrDA.

Two users traveling with laptop computers can transfer files by setting up an IrDA connection, instead of using cables or floppy disks. When users place two computers close to one another, IrDA can automatically configure the connection.

Windows XP Professional lets you limit users—other than the computer's owner—who can send files using infrared communications. You can also specify the location where documents should be received.

Windows XP Professional automatically detects devices that use infrared communications, such as other computers and cameras.

PPPoE Client

Windows XP lets you create connections using PPPoE. Using PPPoE and a broadband modem, mobile LAN users can gain individual authenticated access to high-speed data networks.

Callback

Windows XP also supports callback modem configurations, The callback feature instructs the remote access server to disconnect, and then to call you back after you dial-in. Callback provides cost advantages to you and security advantages to your network.

Encrypting File System

The increased functionality of Encrypting File System (EFS) has significantly enhanced the power of Windows XP Professional by providing additional flexibility for corporate users when they deploy security solutions based on encrypted data files. One of the cornerstones of mobile computing's data and access security is EFS.

EFS Architecture

EFS is based on public-key encryption and takes advantage of the CryptoAPI architecture in Windows XP. The default configuration of EFS requires no administrative effort—you can begin encrypting files immediately. EFS automatically generates an encryption key pair and a certificate for a user if one does not exist already.

EFS can use either the expanded Data Encryption Standard (DESX) or Triple-DES (3DES) as the encryption algorithm. Both the RSA Base and RSA Enhanced software that cryptographic service providers (CSPs) included in the operating system may be used for EFS certificates, and for encryption of the symmetric encryption keys.

Note: If you encrypt a folder, all files and subfolders created in, or added to, the encrypted folder are automatically encrypted. It is recommended that you encrypt at the folder level to prevent plain-text temporary files from being created on the hard disk during file conversion.

EFS and NTFS

EFS protects sensitive data in files that are stored on disk using the NTFS file system. EFS is the core technology for encrypting and decrypting files stored on NTFS volumes. Only the user who encrypts a protected file can open the file and work with it. This is especially useful for mobile computer users because even if someone else gains access to a lost or stolen laptop, he or she will not able to access any of the files on the disk. Windows XP Professional enables EFS to work with offline files and folders.

Mobile Security Tip Use EFS on mobile NTFS volumes. NTFS coupled with the Encrypting File System scrambles the contents of documents so that they're unreadable by unauthorized people. Mobile computer data protected by EFS can't be compromised.

EFS enables you to encrypt individual files and folders. Encrypted files will remain confidential even if an attacker bypasses system security by installing a new operating system. EFS provides strong encryption through industry standard algorithms, and because it is tightly integrated with NTFS, it is easy to use. EFS for Windows XP Professional offers new options for sharing encrypted files and disabling data recovery agents, and it facilitates management through Group Policy and command-line utilities.

Mobile Security Tip Make sure you implement strong passwords when using EFS. Since EFS protects files based on the local user's certificate, encrypted files are only as secure as the password associated with that user's account on the system.

Maintaining File Confidentiality

Security features such as logon authentication and file permissions protect network resources from unauthorized access. However, anyone with physical access to a computer can install a new operating system on that computer and bypass the existing operating system's security. In this way, sensitive data can be exposed. Encrypting sensitive files using EFS adds another layer of security. When files are encrypted, their data is protected even if an attacker has full access to the computer's data storage.

Only authorized users and designated data recovery agents can decrypt encrypted files. Other system accounts that have permissions for a file—even the Take Ownership permission—cannot open the file without authorization. Even the administrator account cannot open the file if that account is not designated as a data recovery agent. If an unauthorized user tries to open an encrypted file, access will be denied.

How EFS Works

EFS enables you to store confidential information about a computer when people who have physical access to your computer could otherwise compromise that information, intentionally or unintentionally.

EFS is especially useful for securing sensitive data on mobile computers or on computers shared by several users. Both kinds of systems are susceptible to attack by techniques that circumvent the restrictions of ACLs.

In a shared system, an attacker can gain access by starting up a different operating system. An attacker could also steal a computer, remove the hard drive(s), place the drive(s) in another system, and gain access to the stored files. Files encrypted using EFS, however, appear as unintelligible characters when the attacker does not have the decryption key.

Because EFS is tightly integrated with NTFS, file encryption and decryption are transparent. When you open a file, it is decrypted by EFS as data is read from disk. When you save the file, EFS encrypts the data as it is written to disk. As an authorized user you might not even realize that the files are encrypted because you can work with them as you normally do.

In its default configuration, EFS enables you to start encrypting files from Windows Explorer with no administrative effort. From a user's point of view, encrypting a file is simply a matter of setting a file attribute. The encryption attribute can also be set for a file folder. This means that any file created in or added to the folder is automatically encrypted.

Figure 1 below shows where you would create settings for EFS.

Figure 1: EFS Local Security Settings

Configuring EFS for Your Environment

EFS is enabled by default. You can encrypt files if you have permission to modify the files. Because EFS relies on a public key to encrypt files, you need a public-private key pair and a public key certificate for encryption. Because EFS can use self-signed certificates, it does not require administrative effort before it can be used.

If EFS is not appropriate in your environment, or if you have files that you do not want encrypted, you can disable EFS in various ways. There are also a number of ways in which you can configure EFS to meet the specific needs of your organization.

In order to use EFS, all users must have EFS certificates. If you do not currently have a Public Key Infrastructure (PKI), you can use self-signed certificates that are generated by the operating system automatically. If you have certification authorities, however, you might want to configure them to provide EFS certificates. You will also need to consider a disaster recovery plan if you use EFS on your system.

What Can Be Encrypted

Individual files and file folders (or subfolders) on NTFS volumes can be set with the encryption attribute. Although it is common to refer to file folders with the encryption attribute set as "encrypted," the folder itself is not encrypted, and no public-private key pair is required to set the encryption attribute for a file folder. When encryption is set for a folder, EFS automatically encrypts the following:

• All new files created in the folder.

• All plaintext files copied or moved into the folder.

• Optionally, most existing files and subfolders; with the noted exceptions of Windows system files and user profiles

Note: The process of moving files from a unencrypted directory to an encrypted directory, using GUI drag and drop, will not encrypt the files moved into the encrypted directory.

Encrypting Offline Files

Windows 2000 introduced client-side caching functionality, now called Offline Files in Windows XP Professional. The offline files feature is a Microsoft IntelliMirror® management technology that allows network users to access files on network shares even when the client computer is disconnected from the network. When disconnected from the network, mobile users can still browse, read, and edit files because they have been cached on the client computer, and now with Windows XP Professional these offline files are encrypted/decrypted in real-time. When the user later connects to the server, the system reconciles the changes with the server.

Mobile Security Tip The Windows XP Professional client can use EFS to encrypt offline files and folders. This feature is especially attractive for traveling professionals who need to work offline periodically and maintain data security.

Encrypting the Offline Files Database

You now have the option to encrypt the Offline Files database. This is an improvement over Windows 2000, where the cached files could not be encrypted. Windows XP Professional offers you the option of encrypting the Offline Files database to safeguard all locally cached documents from theft while at the same time providing additional security to your locally cached data.

For example, you can use offline files while keeping your sensitive data secure. And if you're an IT administrator you can use this feature to safeguard all locally cached documents. Offline Files is an excellent safeguard if your mobile computer, with confidential data saved in the Offline Files cache, gets stolen.

This feature supports the encryption and decryption of the entire offline database. Administrative privileges are required to configure how the offline files will be encrypted.

To encrypt offline files

1. Go to Folder Options under Tools in My Computer

2. Check Encrypt offline files to secure data under the Offline Files tab as shown in Figure 2 below.

Figure 2: Encrypting the Offline Files database

Certificate Services

Certificate Services is the part of the core operating system that allows a business to act as its own certification authority (CA), and issue and manage digital certificates. Windows XP Professional supports multiple levels of a CA hierarchy and a cross-certified trust network: This includes offline and online certificate authorities. The following sections discuss certificate services and related topics.

Certificate and Public Key Storage

Windows XP Professional stores your public key certificates in the personal certificate store. Certificates are stored in plaintext because they are public information, and they are digitally signed by certification authorities to protect against tampering.

User certificates are located in Documents and Settings\username\ApplicationData\Microsoft\ SystemCertificates\My\Certificates for each user profile. These certificates are written to the personal store in the system registry each time you log on to your computer. For roaming profiles, your certificates can be stored anywhere and will follow you when you log on to different computers in the domain.

Private Key Storage

Private keys for the Microsoft-based cryptographic service providers (CSPs), including the Base CSP and the Enhanced CSP, are located in the user profile under RootDirectory\Documents and Settings\username\Application Data\Microsoft\Crypto\RSA.

In the case of a roaming user profile, the private key resides in the RSA folder on the domain controller and is downloaded to your computer, where it remains until you log off or the computer is restarted.

Because private keys must be protected, all files in the RSA folder are automatically encrypted with a random, symmetric key called the user's master key. The user's master key is 64 bytes in length and is generated by a strong random number generator. 3DES keys are derived from the master key and are used to protect private keys. The master key is generated automatically and is periodically renewed.

When storing the master key on disk, it is triple-DES protected by a key based in part on your password. It encrypts each file in the RSA folder automatically as the file is created.

User Certificate Autoenrollment

Windows 2000 introduced machine certificate autoenrollment; Windows XP and Windows Server 2003 introduce user certificate autoenrollment and renewal. Autoenrollment for computer or domain controller certificates is enabled through Group Policy and Microsoft Active Directory™. Autoenrollment of computer certificates is most useful in facilitating an IPSec or L2TP/IPSec VPN connection with Windows XP Routing and Remote Access servers and other similar devices.

Certificate autoenrollment lowers total cost of ownership and simplifies the certificate management life cycle for users and administrators. Automatic smart card enrollment and self-registration authority features provide enhanced security for enterprise users; this is in addition to simplified security processes for security conscious organizations.

Mobile Security Tip Smart cards provide tamper-resistant storage for protecting private keys, account numbers, passwords, and other forms of personal information. Smart cards enhance software-only solutions, such as client authentication, single sign-on, secure storage, and system administration. Smart cards are an important component of the public key infrastructure that Microsoft integrates into the Windows platform.

Pending Certificate Requests and Renewal

User autoenrollment in Windows XP Professional supports both pending certificate requests and renewal features. You can manually or automatically request a certificate from a Windows Server 2003 CA. This request is held until administrative approval is received or the verification process is completed. Once the certificate has been approved or issued, the autoenrollment process will complete and install your certificates automatically.

The process for renewing expired user certificates also takes advantage of the autoenrollment mechanism. Certificates are automatically renewed on behalf of the user—dependent upon the specifications in the certificate template in Active Directory.

Certificates and keys are protected by default. Additionally, you can implement optional security measures to provide extra protection. If you need to increase the security of your certificates and keys, you can export private keys and store them in a secure location.

Figure 3 below shows some of the options available for setting up certificate autoenrollment.

Figure 3: Autoenrollment Settings Properties

Credential Management

Credential Management in Windows XP has three components: credential prompting UI, stored user names and passwords, and the keyring. Together, these three components create a single, sign-on solution.

Credential Prompting

The credentials prompting UI is displayed by an application when an authentication error is returned by the authentication package. (This is only applicable for applications that have implemented the UI.)

From the dialog box you can enter a user name and password, or select a X.509 certificate from the My Store object. The application also has the option of displaying the Remember my password check box, which allows you to save your credential for later use. This is shown in Figure 4 below.

Only integrated authentication packages (for example, Kerberos protocol, NTLM, SSL, and so on) allow credentials to be saved. For basic authentication the credentials prompting UI will still be shown, but you will not have the option of saving your credential.

Figure 4: Prompt for Credentials User Interface

Stored User Names and Passwords

Stored User Names and Passwords is the secure roamable store where your saved credentials are kept. Access to the credentials is controlled by the Local Security Settings (LSA). The credentials are stored based on the target Information returned by the resource.

When the credential is saved by checking the Remember my password check box on the credentials prompting UI, the credential will be saved in the most general form possible. For example, if you were accessing a specific server in a domain, the credential could be saved as *.domain.com. Saving a different credential for a different server in this domain would not overwrite this credential. It would be saved against more specific target information.

When a resource is accessed through an integrated authentication package, the authentication package will look in Stored User Names and Passwords for the most specific credential that matches the target Information returned by the resource. If one is found, the credential will be used by the authentication package without any interaction from you. If a credential is not found, an authentication error will be returned to the application that attempted to access the resource.

Note: The application that is accessing the resource does not need to have implemented the credential prompting UI to use this seamless authentication. If the application uses an integrated authentication package, the authentication package will attempt to retrieve the credential. In fact, if you entered the credential, only the authentication package can retrieve it.

Figure 5: Classic Password Management UI (Windows XP Professional in a Domain)

Remote Access uses Credential Manager Keyring

Remote Access participates in the keyring by adding a temporary default credential whenever a dial-up or VPN connection is successfully established. This credential contains the username and password that were used in setting up the connection since these are often the same credentials that will enable access to the resources on that network. This makes the experience of connecting to a remote network, and using resources on both that network and your local network, seamless.

Keyring

The keyring allows you to manually manage the credentials that are in Stored User Names and Passwords. The keyring is accessed through the User Accounts applet in the Control Panel.

In the keyring you will see a list of all the credentials currently in Stored User Names and Passwords. When each credential is highlighted, a description field at the bottom will display a brief description of the credential. From there you can add a new credential, edit an existing credential, or remove an existing credential.

• Adding a credential. To add a credential you will be presented with a UI similar to the credential prompting UI, and you will need to fill in the target Information. Remember that target information can accept wildcards in the form of "*".

• Editing a credential. Editing a credential enables you to change the target information or the credential itself. If this is a user name and/or password credential, you can change the password on the server from here. You will not be able to use the credentials prompting UI to edit credentials that have been created specifically by an application. For example, you cannot edit passport credentials.

• Removing a credential. You can remove any credential.

The ability to save credentials in Stored User Names and Passwords can be switched on or off through Group Policy.

Mobile Security Tip For the highest level of security, network managers can disable the saving credentials feature in the keyring. This will eliminate the possibility of an unauthorized person with a stolen mobile computer gaining access to your network infrastructure.

Summary

Windows XP Professional offers a complete set of security and privacy solutions that combat threats to mobile computers. Encrypted files on NTFS-formatted storage volumes, group policies, and encryption provide strong data security foundations; tightly integrated, domain-based network authentication; secure networks; traceable user and machine certificates; localized, encrypted credential storage; and no-nonsense password policies complete the set of Windows XP security offerings.

While mobile computer users whose machines are not joined to a domain have fewer security options, both domain and non-domain-connected mobile computer users benefit from secure access to encrypted data while working on the network or offline.

Related Links

See the following resources for further information:

• Analysis of Alleged Vulnerability in Windows 2000 Syskey and the Encrypting File System

• Best Practices for Enterprise Security

  This 12-part series includes:

  • Security Threats

  • Security Considerations for End Systems

• Data Protection and Recovery in Windows XP

• Policy-Based Desktop Management in Windows XP

• Protect Your System from Viruses (Software Restriction Policies supported in Windows XP)

• Security

• Security Newsgroups

• The Ten Immutable Laws of Security

• What's New in Security for Windows XP Professional and Windows XP Home Edition

• Wireless LAN Technologies and Windows XP

For the latest information about Windows XP, see the Windows XP Web site