Stable Windows XP, or correct system setup after installation
This article describes the technology of setting up a computer (before and after installation of the operating system), peeped by me with my teski and a good admin with the nickname jinsan.
The steps described are highly advisory and fairly generalized. How exactly to act at each stage and what software products to use is an individual case for everyone. Each step is briefly and succinctly painted, so that it is clear why and why. The sequence of actions is optimized so as to make fewer unnecessary movements ("do not believe the industrious admin ...." ©)
This article can be taken as a template for further action. The setting is designed for use on client computers (most often at the workplace) and does not provide for beautifulness / convenience.
')
Let's start ...
In my practice, I usually break a hard disk into three sections:
There will be no user information on the system partition - only the operating system.
All file systems are NTFS.
Here I will not go into details - I think everyone went through this stage and know it by heart.
For my installations I use the original Microsoft CD, with the latest updates and without any other bells and whistles. But here it’s a personal matter ...
I usually specify the administrator's password numeric - in the future it will change anyway.
Install all the necessary drivers.
A couple of times I had, that the native driver disk was not readable, or something else, but the drivers were not found on the network one (Windows in its role ...). In this situation, LiveCD saves a lot with the same Slax .
After installing all the drivers (it is worth making sure that the device manager (devmgmt.msc) does not give out any question / exclamation marks), proceed to the creation of the first backup.
To begin with, copy all used drivers to the E: drive, for example, in Drivers daddy.
Then we reboot the system, and boot from Hiren . Select the preferred backup creation wizard (I use Norton Ghost), and create a full backup of the first partition (C :) to the E: drive. How to call an archive is your business, I call it C_Drivers, and in the description I indicate what is installed (in our case, the driver).
Immediately, I note that almost all the actions described here will be invoked via Start-> Run. Almost any of them can be reached through the control panel, but this is a long time, and we still have a lot to do.
We execute (via Start-> Run) lusrmgr.msc, and in users we change the administrator password to your favorite secret password, as well as add the user user. It is better to set him a simple password, for example, also user.
The rest (other users, rights) - at the discretion and requirements of your policy - we consider a common option.
I am sure that during the execution of the previous item, I managed to repeatedly jump out the window of the Security Center that everything is bad and that nothing works. Immediately turn it off, so as not to bother. We click on it with the mouse, and in the appeared window on the left we click “Change the way the notifications are displayed” (or something like that). Remove all the jackdaws and close these windows.
Next, remove the beautiful and special effects: click on Win + Pause, the Advanced tab, the topmost button is Speed. In the window that appears, on the Visual Effects tab, select the item Provide the best performance.
Now we will return the task manager to the three large buttons at home - go to the control panel -> Manage account oxides, and select Edit welcome window. We remove all the jackdaws and close the windows.
Change the folder display mode. Open the explorer and set the table display mode. For convenience, you can slightly stretch the first column. Next, select Tools-> Folder Options-> View. We remove daws from: Use a simple way to display files, remember the display settings for each folder, hide protected system files (confirm), hide extensions for registered file types. We put daws: display the contents of system folders, show hidden files and folders, do not cache thumbnails. Apply changes (click Apply) and click Apply to all folders.
Add the necessary languages ​​and choose the most convenient method for switching them.
First of all - avtoran. Run gpedit.msc. Find: User Configuration-> Administrative Templates (usually the very last item in the tree) -> System. In it we find the item Disable autoload. Set Enable and apply to all drives. OK.
We turn off some unnecessary services: Run-> services.msc. For the following services, I set the startup mode to "disabled":Windows Update , Remote Registry, Windows Time, Windows Themes. You can go through the services and cut even more (initially we left only 13-15 services on client computers).
Forbidden to write to users on drive C: Go to the properties of drive C, on the security tab, make sure that the user does not have write permissions. ATTENTION. When changing this parameter, make sure that in the additional parameters you should not check out the rights of the child folders, otherwise the settings of the Documents and Settings folder are compiled, and the easiest way out is to rearrange everything again.
Install the main applications: Antivirus, archiver, browser.
Install additional applications to your taste.
We bring the necessary shortcuts to the user's desktop (or for all users - C: \ Documents and Settings \ All users \ Desktop)
Now it's time to set up a user. We login under his account and first of all we change the path to the folder My Documents: right-click on the folder My Documents-> Properties-> Path to the folder: D: \ My documents-> Ok-> Yes-> Yes
Back in the administrative account, and change the security for the folder C: \ Documents and Settings \ user \ Desktop. We prohibit the user to write to this folder. You can, of course, climb the registry and change the path to the user's desktop folder, but as for me - this is an easier way. Yes, and aesthetically clean desktop looks much more beautiful than a crap pile of icons and documents.
We prohibit users from changing the path to the My Documents folder: gpedit.msc-> User Configuration-> Desktop-> Prevent Users from changing the path of the My Documents folder.
For the simplicity of poor users, we enable autologin: Run-> control userpasswords2. Remove the checkbox Require user name and password. Specify username and (twice) user password.
We remove the letter from the backup disk: Run-> diskmgmt.msc. We find our disk backups (E :) and right-click, select Change drive letter. Remove all letters.
Reboot.
We fall into the user account, we check that all applications work. In case something does not work, we look for solutions to the problem. Most likely, the application requires the rights to write to its folder - for this, from the admin account, we change the rights to the application folder, and allow the user to write to it (it is better to replace the rights of the child objects as well).
We check that the user can write to the desktop, to the folder my documents and so on.
If everything works, we go further.
After a long setup and painstaking lick of our system, it is worth making another backup. In essence, the process of its creation is no different from the first, except for the name and description.
The advantages of backups can not be overemphasized. In the future, if we had any problems with the computer, which were not solved by a banal reboot, or within 20 minutes, it’s enough to boot from the hiren, put the last image on recovery, pick up the disk, go and drink coffee, and come, just to to reboot the system.
In the case of installing some kind of software, or changing the settings, do not be too lazy to update the backup, because otherwise all the beauty of backups is lost and the method described in the previous paragraph becomes not so elegant, because after each recovery you will have to reinstall the missing software or change settings.
In case there are a lot of identical machines, you can connect an external screw, and make a full image of the original hard disk, then deploy it to all other computers. But this is a separate article.
The steps described are highly advisory and fairly generalized. How exactly to act at each stage and what software products to use is an individual case for everyone. Each step is briefly and succinctly painted, so that it is clear why and why. The sequence of actions is optimized so as to make fewer unnecessary movements ("do not believe the industrious admin ...." ©)
This article can be taken as a template for further action. The setting is designed for use on client computers (most often at the workplace) and does not provide for beautifulness / convenience.
')
Let's start ...
BIOS setting
- Boot priority
To prevent loading from external devices, it is better to leave only the first item, and disable everything else:- HDD
- Disabled or CD-ROM
- Disabled or network
- Password for BIOS
To prevent changing the boot priority of the BIOS. It is better to put the password, which, in which case it is not a pity to reveal. If there is a possibility - it is worth installing it and choosing a boot sequence via a hot button (see further). - Priority download via hot button
Most BIOSes allow you to change the boot priority by pressing a hot button. In some it is F12, F8. If there is an opportunity to put a password on this function, it is better to leave it (in the future, fewer actions will have to be done), otherwise, it is better to disable and change the priority of loading through the BIOS. - Disconnect unnecessary devices
For example LPT and COM ports, USB keyboard and mouse support, Game port. Of course, if you use any of this ...
HDD Preparation
In my practice, I usually break a hard disk into three sections:
- : (SYSTEM) - system, boot. Depending on the intended purpose of the computer - from 20 to 50Gb
- D: (DATA) - the largest section with user data. Takes all available space (excluding E :)
- E: (BACKUP) - The last partition on which backups of the C: drive are stored. In size - one and a half to two times more than the C drive:
There will be no user information on the system partition - only the operating system.
All file systems are NTFS.
Install the operating system
Here I will not go into details - I think everyone went through this stage and know it by heart.
For my installations I use the original Microsoft CD, with the latest updates and without any other bells and whistles. But here it’s a personal matter ...
I usually specify the administrator's password numeric - in the future it will change anyway.
Windows Setup
Drivers
Install all the necessary drivers.
A couple of times I had, that the native driver disk was not readable, or something else, but the drivers were not found on the network one (Windows in its role ...). In this situation, LiveCD saves a lot with the same Slax .
First backup
After installing all the drivers (it is worth making sure that the device manager (devmgmt.msc) does not give out any question / exclamation marks), proceed to the creation of the first backup.
To begin with, copy all used drivers to the E: drive, for example, in Drivers daddy.
Then we reboot the system, and boot from Hiren . Select the preferred backup creation wizard (I use Norton Ghost), and create a full backup of the first partition (C :) to the E: drive. How to call an archive is your business, I call it C_Drivers, and in the description I indicate what is installed (in our case, the driver).
Admin Password and Users
Immediately, I note that almost all the actions described here will be invoked via Start-> Run. Almost any of them can be reached through the control panel, but this is a long time, and we still have a lot to do.
We execute (via Start-> Run) lusrmgr.msc, and in users we change the administrator password to your favorite secret password, as well as add the user user. It is better to set him a simple password, for example, also user.
The rest (other users, rights) - at the discretion and requirements of your policy - we consider a common option.
Appearance and notifications
I am sure that during the execution of the previous item, I managed to repeatedly jump out the window of the Security Center that everything is bad and that nothing works. Immediately turn it off, so as not to bother. We click on it with the mouse, and in the appeared window on the left we click “Change the way the notifications are displayed” (or something like that). Remove all the jackdaws and close these windows.
Next, remove the beautiful and special effects: click on Win + Pause, the Advanced tab, the topmost button is Speed. In the window that appears, on the Visual Effects tab, select the item Provide the best performance.
Now we will return the task manager to the three large buttons at home - go to the control panel -> Manage account oxides, and select Edit welcome window. We remove all the jackdaws and close the windows.
Change the folder display mode. Open the explorer and set the table display mode. For convenience, you can slightly stretch the first column. Next, select Tools-> Folder Options-> View. We remove daws from: Use a simple way to display files, remember the display settings for each folder, hide protected system files (confirm), hide extensions for registered file types. We put daws: display the contents of system folders, show hidden files and folders, do not cache thumbnails. Apply changes (click Apply) and click Apply to all folders.
Add the necessary languages ​​and choose the most convenient method for switching them.
Security
First of all - avtoran. Run gpedit.msc. Find: User Configuration-> Administrative Templates (usually the very last item in the tree) -> System. In it we find the item Disable autoload. Set Enable and apply to all drives. OK.
We turn off some unnecessary services: Run-> services.msc. For the following services, I set the startup mode to "disabled":
Forbidden to write to users on drive C: Go to the properties of drive C, on the security tab, make sure that the user does not have write permissions. ATTENTION. When changing this parameter, make sure that in the additional parameters you should not check out the rights of the child folders, otherwise the settings of the Documents and Settings folder are compiled, and the easiest way out is to rearrange everything again.
Applications
Install the main applications: Antivirus, archiver, browser.
Install additional applications to your taste.
We bring the necessary shortcuts to the user's desktop (or for all users - C: \ Documents and Settings \ All users \ Desktop)
User and his documents
Now it's time to set up a user. We login under his account and first of all we change the path to the folder My Documents: right-click on the folder My Documents-> Properties-> Path to the folder: D: \ My documents-> Ok-> Yes-> Yes
Back in the administrative account, and change the security for the folder C: \ Documents and Settings \ user \ Desktop. We prohibit the user to write to this folder. You can, of course, climb the registry and change the path to the user's desktop folder, but as for me - this is an easier way. Yes, and aesthetically clean desktop looks much more beautiful than a crap pile of icons and documents.
We prohibit users from changing the path to the My Documents folder: gpedit.msc-> User Configuration-> Desktop-> Prevent Users from changing the path of the My Documents folder.
Cosmetic cleaning and inspection
For the simplicity of poor users, we enable autologin: Run-> control userpasswords2. Remove the checkbox Require user name and password. Specify username and (twice) user password.
We remove the letter from the backup disk: Run-> diskmgmt.msc. We find our disk backups (E :) and right-click, select Change drive letter. Remove all letters.
Reboot.
We fall into the user account, we check that all applications work. In case something does not work, we look for solutions to the problem. Most likely, the application requires the rights to write to its folder - for this, from the admin account, we change the rights to the application folder, and allow the user to write to it (it is better to replace the rights of the child objects as well).
We check that the user can write to the desktop, to the folder my documents and so on.
If everything works, we go further.
Second backup
After a long setup and painstaking lick of our system, it is worth making another backup. In essence, the process of its creation is no different from the first, except for the name and description.
Further maintenance.
The advantages of backups can not be overemphasized. In the future, if we had any problems with the computer, which were not solved by a banal reboot, or within 20 minutes, it’s enough to boot from the hiren, put the last image on recovery, pick up the disk, go and drink coffee, and come, just to to reboot the system.
System update.
In the case of installing some kind of software, or changing the settings, do not be too lazy to update the backup, because otherwise all the beauty of backups is lost and the method described in the previous paragraph becomes not so elegant, because after each recovery you will have to reinstall the missing software or change settings.
Cloning
In case there are a lot of identical machines, you can connect an external screw, and make a full image of the original hard disk, then deploy it to all other computers. But this is a separate article.
Source: https://habr.com/ru/post/70226/
All Articles