Limited Users / No AV software --How Safe

I don't feel like using reg hacks and special permissions to enable
virus defs to be automatically downloaded and installed by limited user
accounts. I haven't seen any AV software that installs to the home
directory, I believe they all essentially insist on something in the
'Program Files' directory. Obviously, I am unwilling to create
administrator accounts for all users just for virus defs and thereby
creating a giant catch 22. The way I see it, if I can't install virus
defs in a limited user account, I couldn't install *most* viruses
either. I am about to eliminate this licensing and subscription
headache altogether and opt for mandatory limited user accounts and XP
upgrades. Any opinions? How would a sasser or other exploit
potentially deal with limited user accounts? Thanks.

Tom
Thu Dec 29 17:30:30 CST 2005

Without AV protection, you will not be protected against viruses.

Tom
"shawn modersohn" <smmodersohn@hotmail.com> wrote in message
news:OdFUW9MDGHA.4080@TK2MSFTNGP09.phx.gbl...
|I don't feel like using reg hacks and special permissions to enable
| virus defs to be automatically downloaded and installed by limited user
| accounts. I haven't seen any AV software that installs to the home
| directory, I believe they all essentially insist on something in the
| 'Program Files' directory. Obviously, I am unwilling to create
| administrator accounts for all users just for virus defs and thereby
| creating a giant catch 22. The way I see it, if I can't install virus
| defs in a limited user account, I couldn't install *most* viruses
| either. I am about to eliminate this licensing and subscription
| headache altogether and opt for mandatory limited user accounts and XP
| upgrades. Any opinions? How would a sasser or other exploit
| potentially deal with limited user accounts? Thanks.

Shenan
Thu Dec 29 18:36:50 CST 2005

shawn modersohn wrote:
> I don't feel like using reg hacks and special permissions to enable
> virus defs to be automatically downloaded and installed by limited
> user accounts. I haven't seen any AV software that installs to the
> home directory, I believe they all essentially insist on something
> in the 'Program Files' directory. Obviously, I am unwilling to
> create administrator accounts for all users just for virus defs and
> thereby creating a giant catch 22. The way I see it, if I can't
> install virus defs in a limited user account, I couldn't install *most*
> viruses either. I am about to eliminate this licensing and
> subscription headache altogether and opt for mandatory limited user
> accounts and XP upgrades. Any opinions? How would a sasser or
> other exploit potentially deal with limited user accounts? Thanks.

What type of antivirus application are you trying to use that doesn't work
for all users?

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

shawn
Thu Dec 29 22:35:50 CST 2005

Tom [Pepper] Willett wrote:
> Without AV protection, you will not be protected against viruses.
>
> Tom
> "shawn modersohn" <smmodersohn@hotmail.com> wrote in message
> news:OdFUW9MDGHA.4080@TK2MSFTNGP09.phx.gbl...
> |I don't feel like using reg hacks and special permissions to enable
> | virus defs to be automatically downloaded and installed by limited user
> | accounts.

Apparently, I am protected from updated virus definitions at least.

shawn
Thu Dec 29 22:37:23 CST 2005

Shenan Stanley wrote:
> shawn modersohn wrote:
>
>>I don't feel like using reg hacks and special permissions to enable
>>virus defs to be automatically downloaded and installed by limited
>>user accounts. I haven't seen any AV software that installs to the
>>home directory, I believe they all essentially insist on something
>>in the 'Program Files' directory. Obviously, I am unwilling to
>>create administrator accounts for all users just for virus defs and
>>thereby creating a giant catch 22. The way I see it, if I can't
>>install virus defs in a limited user account, I couldn't install *most*
>>viruses either. I am about to eliminate this licensing and
>>subscription headache altogether and opt for mandatory limited user
>>accounts and XP upgrades. Any opinions? How would a sasser or
>>other exploit potentially deal with limited user accounts? Thanks.
>
>
> What type of antivirus application are you trying to use that doesn't work
> for all users?
>

Norton AV 2005 in non domain workstations.

Lance
Thu Dec 29 22:32:04 CST 2005



shawn modersohn thought carefully and wrote on 12/29/2005 8:37 PM:
> Shenan Stanley wrote:
>
>> shawn modersohn wrote:
>>
>>> I don't feel like using reg hacks and special permissions to enable
>>> virus defs to be automatically downloaded and installed by limited
>>> user accounts. I haven't seen any AV software that installs to the
>>> home directory, I believe they all essentially insist on something
>>> in the 'Program Files' directory. Obviously, I am unwilling to
>>> create administrator accounts for all users just for virus defs and
>>> thereby creating a giant catch 22. The way I see it, if I can't
>>> install virus defs in a limited user account, I couldn't install
>>> *most* viruses either. I am about to eliminate this licensing and
>>> subscription headache altogether and opt for mandatory limited user
>>> accounts and XP upgrades. Any opinions? How would a sasser or
>>> other exploit potentially deal with limited user accounts? Thanks.
>>
>>
>>
>> What type of antivirus application are you trying to use that doesn't
>> work for all users?
>>
>
> Norton AV 2005 in non domain workstations.

Wow, perhaps that's a limitation of NAV 2005. We use the enterprise, or
corporate version called Symantec Antivirus and Symantec Client Security
(firewall) at work and I have SAV installed in 10 computers running
limited user accounts. The install software is provided by our IT dept
so all the permissions/settings are set by them.

I use scheduled scans and each computer checks for updates every hour.
It all works as expected even when the limited user is logged in. The
limited user cannot perform manual Live Updates but can fool with the
firewall settings - I can't see the logic behind that one.

You appear to be in a corporate setting, why are you using
consumer-level software? What does your software vendor have to say
about your hassles and headaches?

Lance
*****

PA
Fri Dec 30 01:24:36 CST 2005

Before You Connect a New Computer to the Internet
http://www.cert.org/tech_tips/before_you_plug_in.html

Protect Your PC
http://www.microsoft.com/athome/security/protect/

Your installed anti-virus app should be configured to seek and install
updates automatically, daily, at a time when the machine is usually running
and connected to the internet. It should also be configured to run a full
system scan a few minutes after seeking/installing updates, also daily.
Anything less is simply insufficient these days.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), Aumha.org VSOP, DTS-L.org

shawn modersohn wrote:
> I don't feel like using reg hacks and special permissions to enable
> virus defs to be automatically downloaded and installed by limited user
> accounts. I haven't seen any AV software that installs to the home
> directory, I believe they all essentially insist on something in the
> 'Program Files' directory. Obviously, I am unwilling to create
> administrator accounts for all users just for virus defs and thereby
> creating a giant catch 22. The way I see it, if I can't install virus
> defs in a limited user account, I couldn't install *most* viruses
> either. I am about to eliminate this licensing and subscription
> headache altogether and opt for mandatory limited user accounts and XP
> upgrades. Any opinions? How would a sasser or other exploit
> potentially deal with limited user accounts? Thanks.

Frank
Fri Dec 30 06:26:32 CST 2005

"shawn modersohn" <smmodersohn@hotmail.com> wrote in message
news:%23E%23d6LPDGHA.2704@TK2MSFTNGP15.phx.gbl
> Shenan Stanley wrote:
>> shawn modersohn wrote:
>>
>>> I don't feel like using reg hacks and special permissions to enable
>>> virus defs to be automatically downloaded and installed by limited
>>> user accounts. I haven't seen any AV software that installs to the
>>> home directory, I believe they all essentially insist on something
>>> in the 'Program Files' directory. Obviously, I am unwilling to
>>> create administrator accounts for all users just for virus defs and
>>> thereby creating a giant catch 22. The way I see it, if I can't
>>> install virus defs in a limited user account, I couldn't install
>>> *most* viruses either. I am about to eliminate this licensing and
>>> subscription headache altogether and opt for mandatory limited user
>>> accounts and XP upgrades. Any opinions? How would a sasser or
>>> other exploit potentially deal with limited user accounts? Thanks.
>>
>>
>> What type of antivirus application are you trying to use that
>> doesn't work for all users?
>>
>
> Norton AV 2005 in non domain workstations.

Perhaps the corporate edition of Norton would be more appropriate. This is
not a recommendation that the personal edition is not intended for corporate
use on a network.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

shawn
Fri Dec 30 11:10:35 CST 2005

Lance wrote:
>
>
> shawn modersohn thought carefully and wrote on 12/29/2005 8:37 PM:
>
>> Shenan Stanley wrote:
>>
>>> shawn modersohn wrote:
>>>
>>>> I don't feel like using reg hacks and special permissions to enable
>>>> virus defs to be automatically downloaded and installed by limited
>>>> user accounts. I haven't seen any AV software that installs to the
>>>> home directory, I believe they all essentially insist on something
>>>> in the 'Program Files' directory. Obviously, I am unwilling to
>>>> create administrator accounts for all users just for virus defs and
>>>> thereby creating a giant catch 22. The way I see it, if I can't
>>>> install virus defs in a limited user account, I couldn't install
>>>> *most* viruses either. I am about to eliminate this licensing and
>>>> subscription headache altogether and opt for mandatory limited user
>>>> accounts and XP upgrades. Any opinions? How would a sasser or
>>>> other exploit potentially deal with limited user accounts? Thanks.
>>>
>>>
>>>
>>>
>>> What type of antivirus application are you trying to use that doesn't
>>> work for all users?
>>>
>>
>> Norton AV 2005 in non domain workstations.
>
>
> Wow, perhaps that's a limitation of NAV 2005. We use the enterprise, or
> corporate version called Symantec Antivirus and Symantec Client Security
> (firewall) at work and I have SAV installed in 10 computers running
> limited user accounts. The install software is provided by our IT dept
> so all the permissions/settings are set by them.
>
> I use scheduled scans and each computer checks for updates every hour.
> It all works as expected even when the limited user is logged in. The
> limited user cannot perform manual Live Updates but can fool with the
> firewall settings - I can't see the logic behind that one.
>
> You appear to be in a corporate setting, why are you using
> consumer-level software? What does your software vendor have to say
> about your hassles and headaches?
>
> Lance
> *****

Duh, I never even thought about corporate edition, which will probably
work as I expect for my domain computers. I suspect that the problem
will probably be the same however for the standalone machines at
satellite offices regardless of version. Now at least I can go asking
directly to Symantec remembering there is a difference between Corporate
and Home versions.

As for why I am using consumer level software, its because it was
inherited. I am in the process of a never performed licensing and
software inventory right now, hence this observation and question.
Anyway thanks to all for the replies.

Lance
Fri Dec 30 10:35:58 CST 2005



shawn modersohn thought carefully and wrote on 12/30/2005 9:10 AM:
> Lance wrote:
>
>>
>>
>> shawn modersohn thought carefully and wrote on 12/29/2005 8:37 PM:
>>
>>> Shenan Stanley wrote:
>>>
>>>> shawn modersohn wrote:
>>>>
>>>>> I don't feel like using reg hacks and special permissions to enable
>>>>> virus defs to be automatically downloaded and installed by limited
>>>>> user accounts. I haven't seen any AV software that installs to the
>>>>> home directory, I believe they all essentially insist on something
>>>>> in the 'Program Files' directory. Obviously, I am unwilling to
>>>>> create administrator accounts for all users just for virus defs and
>>>>> thereby creating a giant catch 22. The way I see it, if I can't
>>>>> install virus defs in a limited user account, I couldn't install
>>>>> *most* viruses either. I am about to eliminate this licensing and
>>>>> subscription headache altogether and opt for mandatory limited user
>>>>> accounts and XP upgrades. Any opinions? How would a sasser or
>>>>> other exploit potentially deal with limited user accounts? Thanks.
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> What type of antivirus application are you trying to use that
>>>> doesn't work for all users?
>>>>
>>>
>>> Norton AV 2005 in non domain workstations.
>>
>>
>>
>> Wow, perhaps that's a limitation of NAV 2005. We use the enterprise,
>> or corporate version called Symantec Antivirus and Symantec Client
>> Security (firewall) at work and I have SAV installed in 10 computers
>> running limited user accounts. The install software is provided by our
>> IT dept so all the permissions/settings are set by them.
>>
>> I use scheduled scans and each computer checks for updates every hour.
>> It all works as expected even when the limited user is logged in. The
>> limited user cannot perform manual Live Updates but can fool with the
>> firewall settings - I can't see the logic behind that one.
>>
>> You appear to be in a corporate setting, why are you using
>> consumer-level software? What does your software vendor have to say
>> about your hassles and headaches?
>>
>> Lance
>> *****
>
>
> Duh, I never even thought about corporate edition, which will probably
> work as I expect for my domain computers. I suspect that the problem
> will probably be the same however for the standalone machines at
> satellite offices regardless of version. Now at least I can go asking
> directly to Symantec remembering there is a difference between Corporate
> and Home versions.
>
> As for why I am using consumer level software, its because it was
> inherited. I am in the process of a never performed licensing and
> software inventory right now, hence this observation and question.
> Anyway thanks to all for the replies.

The computers I handle are non-domain and Symantec works as expected.

Lance
*****

S
Sun Jan 01 05:42:04 CST 2006

In my opinion this is acceptable in strictly controlled and monitored
environments, with little user interaction and custom software.

One example is ATM (as in: automatic telling machine) networks.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

"shawn modersohn" <smmodersohn@hotmail.com> wrote in message
news:OdFUW9MDGHA.4080@TK2MSFTNGP09.phx.gbl...
>I don't feel like using reg hacks and special permissions to enable virus
>defs to be automatically downloaded and installed by limited user accounts.
>I haven't seen any AV software that installs to the home directory, I
>believe they all essentially insist on something in the 'Program Files'
>directory. Obviously, I am unwilling to create administrator accounts for
>all users just for virus defs and thereby creating a giant catch 22. The
>way I see it, if I can't install virus defs in a limited user account, I
>couldn't install *most* viruses either. I am about to eliminate this
>licensing and subscription headache altogether and opt for mandatory
>limited user accounts and XP upgrades. Any opinions? How would a sasser
>or other exploit potentially deal with limited user accounts? Thanks.

Cindy
Thu Feb 23 11:22:49 CST 2006

CA Etrust does not require Administrator privileges to install signature
updates automatically. Neither does free personal AVG anti-virus software.

"shawn modersohn" wrote:

> I don't feel like using reg hacks and special permissions to enable
> virus defs to be automatically downloaded and installed by limited user
> accounts. I haven't seen any AV software that installs to the home
> directory, I believe they all essentially insist on something in the
> 'Program Files' directory. Obviously, I am unwilling to create
> administrator accounts for all users just for virus defs and thereby
> creating a giant catch 22. The way I see it, if I can't install virus
> defs in a limited user account, I couldn't install *most* viruses
> either. I am about to eliminate this licensing and subscription
> headache altogether and opt for mandatory limited user accounts and XP
> upgrades. Any opinions? How would a sasser or other exploit
> potentially deal with limited user accounts? Thanks.
>