1. How PNNL Manages Windows Desktops 1 Will Jorgensen

2. Windows Deployment Services Universal Image! Simpler user interface Quickly update image for new hardware 2

3. Federal Desktop Core Configuration (FDCC) Start October 2008 Classified impact to three levels 80% of settings classified as low Deployed December 2008 Only 2 exceptions 3

4. Least User Access BeyondTrust Privilege Manager for XP 2 year deployment Elevated installer processes Allow “run elevated” ActiveX control white lists De-elevate IE 4

5. Obstacles Broken permissions (File System & Registry) User Training! More calls to the Help Desk Agent instability 5

6. Benefits Additional security layer Better positioned for the future 6

7. Windows Firewall Block all workstation-to-workstation traffic Except RDP and ICMP Help Desk can grant exceptions Benefits Prevents spread from compromised host Eliminates spurious network traffic 7

8. AntiVirus Protection Upgraded to Symantec Endpoint Protection 11 Silent push via SMS 8

9. Software Patching Windows Server Update Services (WSUS) Available externally Microsoft SMS Patch most common vulnerabilities 9

10. Where are we going SCCM Available externally IPS (Symantec Network Threat Protection) Device Certificates Network Access Protection Software Virtualization (App-V) 10

11. Discussion Questions Will@pnl.gov Scott.Snyder@pnl.gov 11