How Secure is Your PC?
Get a free checkup from Microsoft
Personal Security Advisor
By Joshua Feinberg

Is your PC "leaking" confidential information or just a security "wimp"? Find out with this new, free utility from Microsoft!

With all the new viruses and worms floating around the Internet, your small business computer systems may be highly vulnerable to an ever-growing influx of digital threats. However, hiring a computer security expert can be a very expensive undertaking for a small company.

If you don't want to become another statistic, is there a "do it yourself" approach that's affordable and effective? You bet! Microsoft Personal Security Advisor at http://www.microsoft.com/technet/mpsa is a new free online tool that can help you find out about your PC's security problems before it's too late.

Note: Microsoft Personal Security Advisor works with Microsoft Windows NT Workstation 4, Microsoft Windows 2000 Professional, and Microsoft Windows XP.

How it works

From your Microsoft Internet Explorer web browser, go to www.microsoft.com/technet/mpsa.

Microsoft Personal Security Advisor will scan your PC for vulnerabilities associated with the Microsoft Windows NT Workstation 4 and Microsoft Windows 2000 Professional operating systems, Microsoft Internet Explorer, Microsoft Outlook, and Microsoft Office.

After Microsoft Personal Security Advisor completes its evaluation of your PC, you'll get immediate feedback, grading your overall security exposure anywhere from Severe Risk (worst) to Strong Security (best). The report also lists specific suggestions on how to remedy your security vulnerabilities.

Microsoft recommends that you run the Microsoft Personal Security Advisor on a regular basis.

Note that the associated Features and Frequently Asked Questions pages also contain extensive background to help you understand the test results and develop a plan of attack for locking down your PC.

To run the Microsoft Personal Security Advisor, simply click the Scan Now button.

Depending on whether or not you've given carte blanche to install Microsoft web plug ins, you may be prompted to install the MSSecure XML File, as shown above. If prompted, click Yes to install and run.

Also note that the scanning process and provided background information explicitly state that no information from your PC is being sent to Microsoft.

How my PC faired

The first time I ran Microsoft Personal Security Advisor, I received a Severe Risk rating for Overall Security Exposure. Yikes!

While Microsoft Personal Security Advisor rated my PC as having Strong Security in 9 of the 16 areas evaluated, I got one Severe Risk grade for Restrict Anonymous. The balance of the 16 items either received less severe Potential Risk grades or simply Security FYIs.

The Severe Risk grade I received had to do with Restrict Anonymous. The explanation told me that, "You are running with RestrictAnonymous = 0. This should be set to 2 to ensure maximum security."

When I clicked on the related hyperlink to learn more about the Restrict Anonymous security vulnerability, I found out that I could lock down my PC by restricting the amount of information that an anonymous user can glean from my PC. Without hardening this setting, an anonymous user could presumably view my PC's usernames and details, account policies, and share names.

If your PC is on a LAN and behind a proxy server and firewall, Restrict Anonymous is a relatively low risk problem --- unless you're concerned about coworkers trying to "hack" into your PC.

However, if you have a standalone PC that connects directly to the Internet, you'll want to "fix" Restrict Anonymous ASAP, to keep anonymous users on the Internet from gathering information about your PC configuration.

How I fixed the discovered "Restrict Anonymous" security vulnerability

To implement Microsoft Personal Security Advisor's suggestion that I change Restrict Anonymous from a 0 (zero) setting to 2, I simply clicked on the provided hyperlink for "Set 2000 RestrictAnonymous_= 2". Microsoft Personal Security Advisor then automatically made the change in my Registry.

I was prompted to choose between downloading the Registry fix or running it directly from the Internet. I chose the latter. I was also prompted to confirm that I wanted to let Microsoft Personal Security Advisor make the change to my Registry. I confirmed and was then notified that the change was successful.

Testing again to see if the change "worked"

So naturally, I wanted to run Microsoft Personal Security Advisor again to see if the change I just made "worked". So I clicked on the Home button and chose Scan Now.

As expected, my PC's Overall Security Exposure rating was no longer listed as Severe Risk. The Restrict Anonymous category was now listed as Strong Security. So the above changes "worked" as advertised and I didn't have to take on the risk of editing my Registry by hand.

I then spent a few more minutes reviewing each of the four Potential Risk items and implementing the associated recommendations.

Within a half-hour, I had fully "locked down" my Microsoft Windows 2000 Professional PC using the plain English recommendations of the Microsoft Personal Security Advisor.

The Bottom Line

By using the Microsoft Personal Security Advisor I was able to get a well-organized, easy to follow evaluation of my PC's overall security. I didn't have to call in a computer security expert and I didn't have to go on a scavenger hunt to dozens of URLs to track down this information.

Finally, I didn't have to face the risk of "trashing" my PC with manual Registry edits.

Granted, a highly paid computer security expert may have found additional vulnerabilities, but at least I took care of the "obvious" stuff. And since Microsoft Personal Security Advisor is "free", the price is hard to beat!

All of these factors go a long way toward reducing your overall small business computer support costs.

Copyright (C) 2001, KISTech Communications Corporation

Joshua Feinberg is an internationally recognized small business technology expert, consultant, columnist, author, keynote speaker, and trainer. He is a published Microsoft Press author, as well as the creator of and two-year veteran writer of the Microsoft Direct Access "VAPVoice: Notes From the Field" column. Learn what your highly paid computer consultant doesn't want you to know!