Passwords and pesky teenagers

Forums › Desktop computing › Passwords and pesky teenagers

1 | 2 | 3

5655 posts

Uber Geek
+1 received by user: 3978

ID Verified

Trusted

Lifetime subscriber

#1144253 30-Sep-2014 14:32

If you have physical access to the machine compromising a local administrator account is a trivial exercise.

Enabling a strong bios password, disabling booting from removable media, will make this non trivial.
Enabling Bitlocker would pretty much kill any hope but most users are running home OS's that don't support it.

I'm a geek, a gamer, a dad, a Quic user, and an IT Professional. I have a full rack home lab, size 15 feet, an epic beard and Asperger's. I'm a bit of a Cypherpunk, who believes information wants to be free and the Net interprets censorship as damage and routes around it. If you use my Quic signup you can also use the code R570394EKGIZ8 for free setup. Opinions are my own and not the views of my employer.

Lias

5655 posts

Uber Geek
+1 received by user: 3978

ID Verified

Trusted

Lifetime subscriber

#1144256 30-Sep-2014 14:35

martyyn:
The issue with using a BIOS lock is he needed access to the laptop for school work. That's why I think having his own, crappy one will have to be the way to go.

Generally you should be able to set a bios password in such a way that it prevents them altering settings and booting from removable media, but does not prevent them from booting the device.

toyonut

1508 posts

Uber Geek
+1 received by user: 211

#1144273 30-Sep-2014 14:37

Can only do that then, give him the old one for schoolwork and then get a new one for parents. Make it an ULP machine so it is not fast enough for games, something like a low power ultrabook maybe or dare I say it, a Mac Air.
Make the parents account a normal user account too and create an admin user for them to use only when they need to install something. UAC will provide the prompt to authenticate.

My guess would be on him installing a keylogger or something similar if the parents are indeed using a suitably complex password, not entering it around him and locking the computer when they are not using it.

Try Vultr using this link and get us both some credit:

http://www.vultr.com/?ref=7033587-3B

Lias

5655 posts

Uber Geek
+1 received by user: 3978

ID Verified

Trusted

Lifetime subscriber

#1144333 30-Sep-2014 15:49

paulmilbank: Can only do that then, give him the old one for schoolwork and then get a new one for parents. Make it an ULP machine so it is not fast enough for games, something like a low power ultrabook maybe or dare I say it, a Mac Air.
Make the parents account a normal user account too and create an admin user for them to use only when they need to install something. UAC will provide the prompt to authenticate.

My guess would be on him installing a keylogger or something similar if the parents are indeed using a suitably complex password, not entering it around him and locking the computer when they are not using it.

Unlikely to be a keylogger as they'd generally need admin rights to install in the first place, short of using unpatched vulnerabilities.

More likely something like http://pogostick.net/~pnh/ntpasswd/

That tool is one of a variety on the net that can do things like reset or blank passwords, enable and unlock accounts, and escalate accounts (e.g. make them administrators). Just boot off a CD/USB with that loaded and bob's your aunty.

graemeh

2080 posts

Uber Geek
+1 received by user: 226

#1144363 30-Sep-2014 16:14

Lias: That tool is one of a variety on the net that can do things like reset or blank passwords, enable and unlock accounts, and escalate accounts (e.g. make them administrators). Just boot off a CD/USB with that loaded and bob's your aunty.

That is scarily simple, a moron could do it!

Now I understand why school IT support takes the approach of "just reimage it" when a little brat breaks their device.

Inphinity

2780 posts

Uber Geek
+1 received by user: 1184

#1144364 30-Sep-2014 16:17

Lias:
Generally you should be able to set a bios password in such a way that it prevents them altering settings and booting from removable media, but does not prevent them from booting the device.

This. BIOS password, removable boot disabled, and complex password on any admin accounts. Of course, if he can physically access the CMOS battery or any BIOS reset jumpers that the device has, it's still quite possible to bypass.

Dyson

Shop now for Dyson appliances (affiliate link).

SepticSceptic

2263 posts

Uber Geek
+1 received by user: 779

Trusted

#1144380 30-Sep-2014 16:49

Inphinity:
Lias:
Generally you should be able to set a bios password in such a way that it prevents them altering settings and booting from removable media, but does not prevent them from booting the device.

This. BIOS password, removable boot disabled, and complex password on any admin accounts. Of course, if he can physically access the CMOS battery or any BIOS reset jumpers that the device has, it's still quite possible to bypass.

Padlock the case ? Quite a few cases have the lug that allows a padlock to prevent case opening.

rhy7s

673 posts

Ultimate Geek
+1 received by user: 147

#1144395 30-Sep-2014 16:59

Inphinity:
Lias:
Generally you should be able to set a bios password in such a way that it prevents them altering settings and booting from removable media, but does not prevent them from booting the device.

This. BIOS password, removable boot disabled, and complex password on any admin accounts. Of course, if he can physically access the CMOS battery or any BIOS reset jumpers that the device has, it's still quite possible to bypass.

Again, this - plus encryption.

Another possibility for the cost of another license or two for the parents would be if their personal systems were on a Win8(or 7)toGo USB drive e.g. http://www.rmprepusb.com/tutorials/win8togo . Leave the teenager to do what they want on the machine and just boot their own systems from USB when desired.

MadEngineer

4591 posts

Uber Geek
+1 received by user: 2570

Trusted

#1144598 30-Sep-2014 23:45

ESET will block all the malware and can be password protected.

You're not on Atlantis anymore, Duncan Idaho.

hio77

'That VDSL Cat'
13036 posts

Uber Geek
+1 received by user: 3896

ID Verified

Trusted

Lizard Networks

Subscriber

#1144602 1-Oct-2014 03:17

The tools for bypassing windows logins are so easy to use nowdays its no surprise really.

i recall a few years ago playing a prank on a friend at a LAN.. flashdrive to edit registry and enable the administrator account (ofcourse disabled by default on win7, default password.....)

Looking back, there were FAR simpler ways of doing it, and something that after doing it i said yeah.. that was a little too dodgy...

Simply put, 5 mins on google, and you can find plenty of ways to do it..

Password your bios, set it to by default not boot off flashdrives/cds etc, that should hopefully stop it being done too easily, and detour attempts.

Ild say best route is to give the teenager his own machine to fill with crap, keep your antivirus up todate so if he gets anything, your more likely to be able to catch it spreading.

#include <std_disclaimer>

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

DaveDog

336 posts

Ultimate Geek
+1 received by user: 169

#1144789 1-Oct-2014 12:28

If any of my teens did this they'd not get to use the laptop...

Instead of trying to secure it and playing an ongoing game of cat and mouse - talk to the teen and tell them that it isn't good enough, lay down some ground rules and make it clear what the consequences will be if the rules aren't followed...

Buying the teen a laptop of their own is a reward for bad behaviour...

HP

Shop now for HP laptops and other devices (affiliate link).

raytaylor

4076 posts

Uber Geek
+1 received by user: 1296

Trusted

#1145235 1-Oct-2014 23:34

Bios bootup / HDD password
He will need to physically pull the thing apart to crack the password.

A bios password is reset by a jumper or removing the cmos battery on the motherboard.
A hdd password cannot be reset so easily - in fact i dont know any way to reset a hard drive password.

Ray Taylor

There is no place like localhost

Spreadsheet for Comparing Electricity Plans Here

blackjack17

1713 posts

Uber Geek
+1 received by user: 865

#1145252 2-Oct-2014 06:09

What about a cheap desktop in the living room with the monitor facing in?

He can do his school work and they can see what he is doing.

But education about correct use with consequences must come first

Electric kiwi signup credit Sharesies credit

1101

3141 posts

Uber Geek
+1 received by user: 1143

#1145487 2-Oct-2014 11:45

MadEngineer: ESET will block all the malware ....

no...it...wont
NOTHING will block all malware. Nothing. Ive seen malware get passed all common AV programs

It sounds like the kid needs to have some control/restraint imposed on him. Easier said than done at this stage of his life .

There are programs that prevent ANY changes to the system, any changes or newly installed programs are reverted on reboot
DeepFreeze is one, there are others. That works really well . You will need to make sure that DeepFreeze(or similar) allows saving of Doc's though , or simply make it known that docs must be saved to USB

blackjack17

1713 posts

Uber Geek
+1 received by user: 865

#1145522 2-Oct-2014 12:40

Another thing his parents could do is get an original surface rt, has the full office suite but good luck installing anything other than crappy apps

http://www.trademe.co.nz/computers/tablets-ebook-readers/tablets/auction-787757944.htm (surface 2)

http://www.trademe.co.nz/computers/tablets-ebook-readers/tablets/auction-786004945.htm

but it is rewarding poor behaviour

Electric kiwi signup credit Sharesies credit

1 | 2 | 3