November 15th, 2005
How do you stop Sony's rootkit at the office?
Some colleagues of mine were asking me how to stop CDs from auto-playing which allows something like Sony’s rootkit to install on their computers. The solution is actually quite simple and effective with Microsoft Active Directory Group Policy. It’s easy to disable auto-play from every single computer in the Enterprise globally with just a few tweaks in Group Policy and here’s how you do it. The same technique works for individual PCs as well.
Open up the "Active Directory Users and Computers" console. Right click on the top of the Active Directory and click "Properties"
Jump to the "Group Policy" tab, highlight "Default Domain Policy", and then click "Edit".
Expand "Computer Configuration" as shown below and click on the "System" folder. On the right hand pane, double click "Turn off Autoplay". Note that home users can jump to this screen by typing "gpedit.msc" from their "Start-run" prompt. If you’re not sure what that means, it’s probably not a good idea to mess with "gpedit.msc".
Choose "Enable" and select "All drives" to turn auto-play off for any device including CD and DVD drives and hit "Apply".
Close everything out and every computer on your domain is protected against auto-play and the Sony rootkit. Any business or organization that is serious about security should do this immediately.
Ask Bloggie is a joint production by bloggers Dana Blankenhorn, Paul Murphy, George Ou and Jason O'Grady, who need your technology and technology management questions. Please drop them a note either via the talkback section here or by email - to murph@winface.com.
