How To: Protect Any PC Using Windows Steady State

Posted 09/04/2008 at 10:00am | by Justin Kerr

12

Comments

Print

One of the biggest challenges Maximum PC readers often face is the never ending battle we endure when it comes to restoring the PC’s of family and friends. We often find ourselves bombarded with machines that may have once been configured by us, but have become infected or modified beyond recognition. The good news is that Microsoft finally has a solution and it comes in the form of a free add on for Windows XP and Vista which promises to restore sanity to your world.

Windows Steady State goes far beyond a simple group policy editor. It gives users the protection and peace of mind that until now could only be matched by a virtual machine. Simply put, Windows Steady State gives you nearly unlimited control over what can and cannot be done on a protected PC. With the ability to flush unwanted changes with each reboot every new session can be as fresh and snappy as the day you first installed the OS.

The obvious application for Steady State is anyone who maintains a large fleet of public computers, but I would argue that it works just as well for anyone who maintains a troublesome household computer with friends or family who just can’t resist opening email attachments. Steady State gives administrators full control over how users access the internet, how they import and export data, and even what programs they can use. Interested in learning how to master this amazing new utility? Read on to learn how to configure Steady State for your application.

What you'll Need:

• A PC With Windows XP (Any 32 Bit Edition) or Windows Vista (Any 32 Bit Edition) The Operating System Must be Installed on an NTFS partition.

• 4 GB of Free Disk Space

• The Windows Steady State Installer

• 30 Minutes

1.) Download and Install Windows Steady State

First things first, you will need to point your browser over to Microsoft and download your free copy of Windows Steady State. For those of you using Firefox (which I’m guessing is most of our readers), you may want to consider using Internet Explorer for this step. Microsoft will validate your copy of Windows to ensure it is genuine both before downloading and again during installation. Internet Explorer makes this first step easier since a one click ActiveX control makes the process pretty transparent. You can use Firefox, Safari, or just about anything else you can think of, but you’ll just have to jump through a few extra hoops in order to validate.

Once you have downloaded the installer go ahead and launch it when you’re ready. The installer doesn’t offer any installation options to configure,  so we won’t bother walking you through the process of clicking next. I would however caution you to go slow and watch for the option to opt out of the Live Tool bar if you don’t want it.

2.) Protect The Hard Disk **OPTIONAL**

Double click the Windows Steady State Icon on your desktop (shown here) which will launch the application into the main menu screen shown above. Once the interface is up and running click the Protect The Hard Disk option which is circled in red on our screen shot.

**WARNING**

Protecting the hard disk has known (but undocumented) issues with whole drive encryption technologies such as True Crypt. Users with encrypted drives should not use this feature and should skip ahead to step 3.

Even though this step is listed as optional, protecting the hard disk is one the most powerful features in Windows Steady State. When enabled disk protection earmarks a chunk of your free disk space (50% by default) and forms a cache where modified files will be stored during a users session. To be clear, Steady State isn’t creating an image of your hard drive, it simply quarantines any files that are modified during a user’s session to the cache.

When the operating system needs to read a file from the hard drive it first checks the cache to see if a modified version already exists, and if not, retrieves it from the protected section. Since the cache only contains modified copies of the protected files, when the machine is rebooted the cache is easily dumped and your computer will once again rebuild it as changes are made. This protection applies to the entire windows partition and cannot be customized to exclude individual folders. If you require persistent storage, data will need to be stored on a separate drive or partition.

Separate partitions are ignored by steady state and can be interacted with normally. If you find yourself wishing you’d had the foresight to create a separate partition on the machine in question, but don’t want to reformat and start over have no fear. We have a how to guide for that too. If you choose not to use the disk protection feature that is of course your choice. But if you’re serious about protecting the PC from users who don’t need to install new software very often it’s the safest bet. If you choose not to use disk protection, the privileges you grant your users in later steps will need to be much more draconian in order to compensate for this feature not being active. With hard disk protection enabled any mischief a user gets himself into will be wiped clean with every reboot.