Windows SteadyState
From Wikipedia, the free encyclopedia
Windows SteadyState is a tool developed by Microsoft that gives administrators enhanced options for configuring shared computers, such as hard drive protection and advanced user management. It is primarily designed for use on computers shared by multiple people, such as internet cafes, schools, libraries etc. SteadyState is the successor to the Shared Computer Toolkit. SteadyState is available free of charge from Microsoft for computers running genuine copies of Windows XP and Vista.
Contents |
[edit] Version History
Shared Computer Toolkit 1.0, released in 2005.
Windows SteadyState 2.0, released in June 2007, supports Windows XP SP2 Home, Professional, and Tablet editions.
Windows SteadyState 2.5 Beta, released in November 2007, added support for all Windows Vista SKUs[1]
Windows SteadyState 2.5 adds support for Windows Vista SP1 and Windows XP SP3.
[edit] Windows Disk Protection
SteadyState includes the ability to revert a computer to a previously stored state every time it reboots, or when an administrator sets it to. When Windows Disk Protection (WDP) is turned on, writes to the boot volume (the volume containing the Windows directory) are stored in a cache file created by SteadyState. WDP offers three modes of protection:
| Name | Mode | Description |
|---|---|---|
| Remove all changes at restart | Discard | When the machine boots, the cache is cleared thus returning the volume to its previous state. |
| Retain changes temporarily | Persist | Changes saved in the cache are persisted across reboots. At the specified date/time, persist mode expires and switches back to discard mode. The machine is rebooted automatically and the cached changes are discarded. |
| Retain all changes permanently | Commit | When the machine boots, changes currently saved in the cache file are written out to disk and become permanent. The machine is then rebooted and then boots normally. |
[edit] User Settings
User accounts can be locked or forced to log off after certain intervals. A locked account uses a temporary copy of the user's profile during the user's session. When the user logs off, the temporary profile is deleted. This ensures that any changes the user made during his session are not permanent. The user's session can also be limited to a specified duration, or logged off if idle.
[edit] Software Restrictions
SteadyState provides simple control of more than 80 restrictions covering both individual users as well as the system as a whole. Many of these settings are based on Windows' Group Policies, while others are implemented by SteadyState itself. Using SteadyState, an administrator can forbid a user from performing actions that may be undesirable for that environment. Some settings include the ability to turn off the control panel, disable registry editing tools, disable the command prompt, and stop the user from executing batch files or programs not in the windows or program folders.
Computer settings can also be applied. Since SteadyState would normally remove any windows updates or security patches installed, SteadyState can be configured to check for and apply updates in a manner that they will not be removed upon rebooting. Administrators can also choose to make other system-wide changes, such as disabling the welcome screen, removing the shutdown dialog from the logon screen, and hiding the built-in Windows Administrator account.
[edit] Block Programs
The administrator can block access to specified programs on a per-user basis. SteadyState presents a list of programs found in the C:\Program Files directory and on the common desktop. Programs from other locations can be added manually.
[edit] Media Coverage
Episode #129 of Security Now!, a weekly podcast hosted by Leo Laporte and Steve Gibson, was dedicated to Windows SteadyState.
