Windows Physical Securitry

I'm in the habit now of locking my XP Pro machine whenever I walk away for even a few seconds. Today I started wondering if this was enough or does it really create a false sense of security. For example:

Does locking Windows cause Windows to enter a suspended state, or it is still processing. I really can't remember if I've locked a long running process and later come back to find that it had finished. If XP is still alive back there, then what is to prevent a nogoodnick from inserting a USB thumb drive with an evil AUTORUN on it -- either to insert a virus or trojan or copy off secure data?

For that matter, if XP is suspended when locked, then suppose same nogoodnick inserts the USB device into a slot on the back of my computer while I'm at lunch -- who looks at the back of the machine anyway? So, I come back, unlock my XP, it finds the new USB device, and runs the AUTORUN before I realize what's happening.

All this led to to wonder if there is a hack that would lock XP whenever a USB mass storage device (or any USB device for that matter) was inserted. The pain of having to enter my password is much less then the pain of losing data.

Then too, I think its possible to disable AUTORUN is it not?

Regards;
Wolffy

Wolffy,

Yes, you can disable AutoRun. To do so, see here: http://www.annoyances.org/exec/show/article03-018

When the computer is in a locked state, inserting a CD-ROM into the CD-ROM drive, for example, will not cause AutoRun to start. That defeats the purpose of locking your computer and I'm sure Microsoft has thought of this. Yes, when processes are already started and you lock your computer, they will continue to run. For example, if you start disk defragmenter, lock your computer, and come back an hour later, you will find that disk defragmenter has continued running. Once you lock the machine, though, you cannot cause AutoRun to start by inserting a CD in the drive or anything else.

I have AutoRun enabled, and to test this, I locked my computer and placed a music CD in the drive (which I know automatically starts when I'm logged in). Nothing happened.

If you're very interested in the security of your system, you may also want to check this out: Microsoft Security Basline Analyzer

Hope this helps.