Windows XP Configuration Notes

With the release of Windows XP, Microsoft has continued to introduce major security and privacy problems into the computer systems of the world. I am not an XP user, but in the interest of helping those who choose to use it, I am posting these notes about configuring XP to be less presumptuous about what the user considers acceptable software behavior. This is by no means a complete record of vulnerabilities. It's just a list of changes that I would make to an XP system if I had to use it. I plan to add to this list as I learn more about the subject.

July 2004 Update:  NIST now has a draft document called Guidance for Securing Microsoft Windows XP Systems for IT Professionals: A NIST Security Configuration Checklist.  NSA keeps a list of such information as well.  These documents are probably far more current and detailed than what I pieced together when XP was first released.

PRIVACY / SECURITY

  • Switch to classic searching style in both explorer and ie, so queries will not be collected & sent to microsoft. (tweakui -> explorer -> settings) ref: a privacy policy that MS has removed
  • Remove microsoft knowledge base from help and support center. (help & support -> options -> set search options)
  • Disable media player identification / licenses / codec download. (xp-antispy, or media player -> tools -> options -> player)
  • Disable error reporting to microsoft. (system properties -> advanced -> error reporting)
  • Disable remote assistance & remote desktop. (system properties -> remote)
  • Disable automatic updates. (system properties -> automatic updates)
  • Disable services: error reporting, automatic updates, background intelligent transfer service, universal plug-n-play, remote registry, maybe remote desktop help.
  • Disable NETBIOS over TCPIP. (local area connection -> *microsoft* & internet protocol properties -> advanced -> WINS)
  • Add lots of hosts to windows\system32\drivers\etc\hosts using loopback ip address (e.g. 127.0.0.1). Especially: sa.windows.com, sa.microsoft.com (used by help / search assistant), go.microsoft.com (used by Program Compatibility Wizard).
  • Disable cd autoplay (HKLM\system\currentcontrolset\services\cdrom -> autorun, or tweakui -> my computer -> autoplay -> types)
  • Disable or remove support user accounts.
  • ?Rename the administrator account?
  • Install a firewall that will block outgoing traffic by application. (Agnitum Outpost seems quite good, although the 1.x versions can cause some versions of Windows XP and 2000 to crash.)
  • Remove or hide all "internet" games under the start->programs->games menu.

BUGS

  • Install the latest Intellipoint mouse drivers or Logitech mouse drivers to keep ie from going back a page when the mouse wheel is rolled upward through a KVM switch. (I'm currently trying the Intellipoint driver, and telling it that I have a Microsoft Wheel Mouse.)

CONVENIENCE / CONTROL

PERFORMANCE

  • Use windows classic display theme.
  • Disable unnecessary effects. (display properties -> appearance -> effects, system properties -> advanced -> performance settings)
  • Reduce system restore disk space. (system properties -> system restore)
  • Reduce recycle bin disk space.
  • Disable autostart of msn messenger.
  • Remove unused windows components, such as msn messenger.
  • Enable UPS monitor.
  • Reduce thumbnail image quality. (tweakui -> explorer -> thumbnails)
  • Use bootvis.exe to optimize boot sequence. (file -> new -> next boot trace, reboot, trace -> optimize system -> reboot)
  • Set control panel -> program events -> windows explorer -> start navigation to (none)

UTILITIES / INFO
[tibit.com]