Everyone who logs onto a computer on my network wants to install things that I don’t want there. I have successfully stopped them from downloading off the internet through my firewall. My big problem now is CDs and USB drives. The software that we run prevents me from making everyone use a guest account. I’ve tried methods of blocking certain extensions on removable devices, but some crafty folks bring in files with text extensions and then rename them after copying the files onto their Documents folder.

What is the best method of stopping users from accessing executable-type files through removable devices or through non-approved folders? Is AppLocker the answer?

Through the years, we have always relied on Ghost to image our computers, but now there are different and possibly better ways to deploy Windows on a corporate network.

Is the Microsoft Deployment Toolkit a better method of deploying Windows to workstations than the earlier methods (such as drive imaging)? Where can I find videos and tutorials that will teach me how to access all the features and functions of MDT? Will I need to obtain a Phd in MDT to be able to successfully use it?

For example, in our latest situation we were hit with a worm that spread throughout our network, but would not allow us to update Windows until the infection was removed. As you can imagine, this made it extremely difficult to patch the holes that were allowing the worms and malware through in the first place, thus our computer kept re-infecting themselves after we would clean them.

Can you suggest the proper method for cleaning up these types of network-wide infections? What procedure should we use that would cause the least amount of downtime to our employees? If you could provide this in a step-by-step approach it would be appreciated.

In today’s world, the use of the Internet is crucial to day to day business operations. Even with firewalls and anti-virus software, users still get infected with virus’s and malware. Most notable is the drive by downloads and related vectors of infection. The most common example would be the rouge, fake anti-virus programs.

As we look forward to windows 7 in the enterprise along with the enhancements that cloud computing bring to the anti-virus software, is there a better way to sandbox or secure the browser model from drive by downloads and similar vectors of attack?

Novell comes with Zen, which has a number of features that do not come standard with Windows. One is an image deployment method. Microsoft has come a long way in this, but it’s not nearly as simple as it is with Zen. Remote control access to computers — Windows users need to rely on products like VNC or websites like Dimdim. Remote access to files — Novell has netstorage, and while Windows now has DirectAccess, schools do not have the ability to upgrade every piece of equipment to Windows 7 and Server 2008 R2. Finally, login password policies — Grace periods after a certain number of incorrect attempts, only allow a single user login at a time.

How do I tell a school that it is better to switch to Microsoft when they get all these things with Novell? If they switched, they would have to rely on third-party software and pay a lot extra for the features.

Some of my clients are required to meet regulations related to the government, health and financial markets (such as Section 404 of the Sarbanes Oxley Act). While most issues have been covered by my colleagues, I have still one issue that remains unanswered, and I seek advice.

As more and more external vendors and out-sourcing experts are connecting to our networks, I would like to generate daily reports about what these privileged users are doing on my servers and applications, especially high risk activities like privileged user behavior, direct access to sensitive data stores, user privilege escalation, failed logins, and failed database operations.

To demonstrate compliance and ensure security best practice, organizations need to have comprehensive, trustworthy database security controls that protect access to data and control changes to it. However, using Windows logging/auditing or firewall logs can show me who has connected, but not what they did once they connected.

We are looking into a solution that will help us meet these regulations and automate these controls.

Any advice will be greatly appreciated.

We are using stored procedures (looping) to count legs for each ID. We want to know what should be the best method to do such calculations?