Link to home
Start Free TrialLog in
Avatar of MRS
MRSFlag for United States of America

asked on

Format the drive if domain is not available maybe?

Is there anything out there or does anyone have any idea of how would i achieve next:
We have a lot of PC's in the company. Windows 7 64 bit all. Is there any way that if someone take the PC out of the building and tries to start it, it automatically delete/format HDD?
Reason is sensitive information stored so we want to make sure if someone stills a PC it wont be useful. Now i understand that everything is retrievable including the formatted drive but at least we will feel better if someone takes it and is not that tech savvy.  
Encryption of the drive is not an option because you would have to share password among users that potently will be the one stilling a PC.

I was thinking like some kind of network authentication, since we are on a domain. If domain is not available, format the drive. There, if someone stills the PC or brings it outside the network it will format the drive. Also in the boot process it will make sure domain is available before it boots all the way to the Windows log on.

If anyone has any other idea, please let me know and also how to achieve this. As of now i do not know of any program that exists that will do this.
Avatar of jerseysam
jerseysam
Flag of United Kingdom of Great Britain and Northern Ireland image

If the PC's are HP etc and you have a recovery partition then you should be able to restore the PC to factory image and then just turn off so its as new. F11 on startup for HP
Avatar of MRS

ASKER

PC's are all Dell Optiplex.
The best approach I see is to use a remote wipe where when the device connects to the internet it reports in and if not on the domain then a wipe command is sent to wipe the drive.

You can use  software like Remote Wipe : https://diskagent.com/products/remote_wipe.php

Just do an internet search on "remote wipe a stolen pc" for other ways to do it.
Avatar of MRS

ASKER

I am not sure if i understand your answer. Can you explain how would i achieve what i am asking?
I know about this option but how would that run automatically if domain network is not available?
Avatar of MRS

ASKER

Thank you West Miller. That is kind of what i was looking. Thanks.
Avatar of MRS

ASKER

Ok and i thing it would work but what if i can't contact this PC at all? This link that you sent is only if the PC is still on the network or some way you can still get in touch with it to send this destroy command.
If it's stolen, many times you cant get to it to issue the command therefore remote wipe is useless, right?
Having the condition of a format because the network is not available is a bad idea. I say that because then if you ever have network issues in your office, get ready to be busy rebuilding every machine. I would use a product like LoJack from Absolute. It has remote wipe capabilities as well as location technology and remote lock capabilities.
Avatar of Saschao
Saschao

just to verify what you are talking about:

you want to format the harddrive if the deivce thinks its not on your site anymore?

1. formatting or deleting partitions is nothing, 15 minutes will be needed to restore it if someone have physical access to the device - you need to overwrite every sector except you have ssd then maybe you can have a much shorter/less effort way

2. Imagine network cable is off or broken so device is not online and then? Its offline and will delete itself.

3. do you want to feel good or do you want to have a security concept?

4. So much is depending on how you are working (thinking about thin clients where no sensitive informations can be stored on but then you need terminalserver access companywide)

and so on
Avatar of MRS

ASKER

Thanks Zac, but this will happen only on a reboot. So even if we have issue with network it's fine unless we have it in the middle of the night when all the PC's reboot and network is unavailable. This doesn't happen. Even if it happens, we have a build process in place where we can build from network in 20 minuets.
What about just locking down the machines so that no data can be stored locally.  Have all of your data on the server (that's where it should be anyways).  That way if a machine walks, just remove the machine account and your data is safe.
Avatar of MRS

ASKER

Saschao,
yes i know and stated that format would be sufficient for our environment. I know it is not as secure as low level format but at least it's something.
Also thin clients would work however we are not on the level yet. Need to upgrade some infrastructure for that.
As far as individual PC that are not able to talk on the network due to broken cable or whatever reason, then i don't want them out there. Because they often don't get any updates nor domain policies due to that issue, so it would ideally be like no network/domain=no boot.
And as i stated, i can easily redeploy image via network in 20 minutes. That is with as many PC's as i like as it is image over network.  So 1 or 100 still will take 20 minutes to get it going again.
This can be done with GPOs and you can also disable USB ports so that nothing can be stored to portable drives.

Basically turn them into thin clients.
Avatar of MRS

ASKER

ScottCha, yes we already have this in place, however this is not pleasing my head of IT department and some auditors.
So again if anyone knows any way to do this, ever write a program/script  that will run on a boot, if domain not available, just issue format C.
Avatar of MRS

ASKER

Again i know all the risk of this, however i am willing to try it.
So script/program runs on the boot and checks for domain. If available proceed to boot if not wipe the drive.
Is there any other creative way?
In addition, if you get someone who knows just a little about how things work, all they'd have to do is pull the HD from the computer, slave it off of another machine and then the drive won't get formatted, they'll be able to read any of the data.

Or they could boot with a 'nix disk and access the data, again with no formatting taking place.  That's 2 ways to get around this "solution" that I thought up in about 2 minutes.

If this idea makes the head of your IT department feel safer.....wow....just wow......
Avatar of MRS

ASKER

I understand ScottCha but at this point lets assume none of the data is on the HDD, and we just want another process in place that will wipe the drive as well.
I need solutions on question that i asked, not suggestions on different problem.
We already took all the measures to make sure that data is not stored, however this is not good enough and my  manager wants me to figure this process and put it in place. Any suggestions on how to achieve this?
Avatar of MRS

ASKER

Please people,
i am willing to explain everything to make it easier for you to give me a suggestion on my problem but don't answer the question with, "this is bad idea", or "why don't you do this instead.."
I am willing to take in considerations any suggestion but there is a reason why i asked the specific question that i need solution/suggestion on. Suggestion on how to achieve the requested.
Avatar of MRS

ASKER

I am not asking here what my options are, well kind of. You are welcome to suggest any options but only to a specific questions. If some ask you for directions to Walmart to you reply: Why don't you go to Target instead? No.
And this is what i am trying to say to people who are trying to be "smart" with their answers.
There is a reason why i asked the specific question and i need a suggestion or an answer on how to achieve this. Again i am not being ignorant to people who are trying to help, but keep in mind i have access to google as well, and have been google my problem, and was thinking about it before i came to this forum.
And I do appreciate all your answers.
then you should do it in another way.

clean the localharddrive and plug it off and boot a windows installation over pxe, i have no personal experience with that but it should be possible:

http://etherboot.org/wiki/index.php

no local system and no local data

german article for using that:

http://www.heise.de/netze/artikel/gPXE-223910.html

otherwise i have no clue how to manage your wishes...
You could use encryption and a credential login that changes daily.

So if the Pc is booted up with no network it will refuse the user to login to the system.

Encrypted if they swap it to another PC it still won't be accessible unless the have an encryption key for that PC which changes every few minutes.
USB dongles are typically used in software licensing schemes to unlock software capabilities,[48] but they can also be seen as a way to prevent unauthorized access to a computer or other device's software. The dongle, or key, essentially creates a secure encrypted tunnel between the software application and the key. The principle is that an encryption scheme on the dongle, such as Advanced Encryption Standard (AES) provides a stronger measure of security, since it is harder to hack and replicate the dongle than to simply copy the native software to another machine and use it. Another security application for dongles is to use them for accessing web-based content such as cloud software or Virtual Private Networks (VPNs).[49] In addition, a USB dongle can be configured to lock or unlock a computer.[

Per: https://en.wikipedia.org/wiki/Computer_security#Computer_protection_.28countermeasures.29
Avatar of MRS

ASKER

Thank you Saschao, this is essentially thin client, and eventually we will get to that. Just don't have it in place now.
I was thinking that it might be any other way to achieve this that i can't think of.
Thank you for your suggestions.
Avatar of MRS

ASKER

Thank you Wes MIller i will explore more of the encryption part and how to implement it in our environment.
We tried to do this once but due to hing cost of encryption programs (license per PC) we didn't go for it.
I believe this is probably what you are looking for:
http://www.safenet-inc.com/multi-factor-authentication/security-applications/etoken-network-logon/

I attached a Document on what Safe net has to offer.
Authentication-Network-Logon-PB--EN-.pdf
Why don't you also physically lock the computer to the desk and facility, so they can't be easily stolen in the first place.  You should also implement cameras and secure cardkey locks to track the users that come into the building and into the rooms that the computers reside.  These are probably the 1st few steps of your security process.  The remote wipe is after the fact.

http://www.noblelocks.com/category/desk.html
http://www.pc-safe.co.uk/shop/computer-security-cages/desktop-pc-security/enclosed-desktop-pc-server-security-cage

You should still add disk encryption even if you do a remote wipe.  The disk encryption makes a remote wipe simpler and quicker to do.  If you don't encrypt the disk, the remote wipe needs to go over the entire disk to securely wipe the data and that takes time.
BitLocker is included in the Pro editions of 8 & 10, or Ultimate editions of Windows 7, or Enterprise editions of any (aka volume licensed editions).

Enact full-drive encryption, and mandate strong passwords, so if a PC is stolen the drive contents can't be accessed:
https://technet.microsoft.com/en-us/library/dd835565(v=ws.10).aspx
Avatar of MRS

ASKER

Maybe Thin Client is the way to go. With PXE boot and no HDD in existing PC's? Therfore if you still a PC it's not good as there is no HDD.
ASKER CERTIFIED SOLUTION
Avatar of serialband
serialband
Flag of Ukraine image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of MRS

ASKER

We do have all that in place already Serialband. Thanks for suggestions.
What I was trying to point out was that even if you have a system in place you don't have a guarantee of the drive being formatted if the computer is booted from a stand along cd/DVD.

And removing the hard drives does not make a computer useless.  A new HDD can be purchased for $60 or less.

I think the reason your not getting the answer you are looking for is that the answer you are hoping to get just doesn't exist. Sometimes "there has to be a way" just isn't true.
Avatar of MRS

ASKER

Not looking to spend $60K on licensing for Thin Clients but it looks like thats the way to go.
You don't have to spend $60k.  You can still have disks on the local desktop client systems.  You just use Remote Desktop for the critical server applications and block the clients from accessing data and storing data locally.
Hi.

Came across this old question by chance today.
The question says:
I was thinking like some kind of network authentication, since we are on a domain. If domain is not available, format the drive. There, if someone stills the PC or brings it outside the network it will format the drive. Also in the boot process it will make sure domain is available before it boots all the way to the Windows log on.
Apart from the formatting capabilities, this is exactly what a bitlocker feature called "network unlock" can do. If the domain is available, the system boots, else, it does not. However, you would need Windows 8.1 or windows 10 for it - but maybe you plan to upgrade someday in the near future.
Avatar of MRS

ASKER

Ok thanks. We are going down that path. Thank you.
Be aware that in order to use it, you'd have to meet certain requirements. All listed here: https://technet.microsoft.com/en-us/library/jj574173(v=ws.11).aspx