How Does Bit Torrent Work ?






















BitTorrent is the name of a client application for the torrent peer-to-peer (P2P) file distribution protocol. created by programmer Bram Cohen. BitTorrent is designed to widely distribute large amounts of data without incurring the corresponding consumption in server and bandwidth resources (and typically, monetary fees attracted as a result of that).

The original BitTorrent application is written in Python and its source code has been released under the BitTorrent Open Source License (a modified version of the Jabber Open Source License), as of version 4.0. The name "BitTorrent" refers to the distribution protocol, the original client application, and the .torrent file type.

The bittorrent protocol breaks the file(s) down into smaller fragments, typically a quarter of a megabyte (256 KB) in size. Peers download missing fragments from each other and upload those that they already have to peers that request them. The protocol is 'smart' enough to choose the peer with the best network connections for the fragments that it's requesting.

To increase the overall efficiency of the swarm (the ad-hoc P2P network temporarily created to distribute a particular file), the bittorrent clients request from their peers the fragments that are most rare; in other words, the fragments that are available on the least number of peers, making most fragments available widely across many machines and avoiding bottlenecks.

The file fragments are not usually downloaded in sequential order and need to be reassembled by the receiving machine. It is important to note that clients start uploading fragments to their peers before the entire file is downloaded.

Sharing by each peer therefore begins when the first complete segment is downloaded and can begin to be uploaded if another peer requests it. This scheme is particularly useful for trading large files such as videos and operating systems. This is contrasted with conventional file serving where high demand can lead to saturation of the host's resources as the consumption of bandwidth to transfer the file to many requesting downloaders surges.

With BitTorrent, high demand can actually increase throughput as more bandwidth and additional “seeds” of the file become available to the group. Cohen claims that for very popular files, BitTorrent can support about a thousand times as many downloads as HTTP.

BitTorrent-etiquette

Because BitTorrent relies on the upstream bandwidth of its users — and the more users, the more aggregate bandwidth is available for sharing the files — it is considered good etiquette to leave one's BitTorrent client open after downloading has completed so that others may continue to gain from the file that has been distributed.

It is not clear, however, how long one should leave their client open after downloading has finished. Many clients report the byte traffic upstream as well as down, so the user can see how much they have contributed back to the network. Some clients also report the "share ratio", a number relating the amount of data uploaded to the amount downloaded. It is generally considered good form to at least share back the equivalent amount of traffic as the original file size.

It is worth noting that the requirement of a "1.00" share ratio (uploading as much data as you have downloaded) is rather hotly contested given its relative impossibility to achieve for every person. On any given torrent, the best possible outcome is the original seeder with an infinite ratio (having only uploaded data and never downloaded any data), a number of peers with 1.00 ratios (having downloaded the file, uploaded just as much data, and then promptly logged off), and two users with a .50 ratio (the last two having each downloaded a separate half of the file and then shared their half with the other). This is highly unlikely to be achieved due to the very small chance of the last two peers downloading completely opposite halves and finishing just as the last seeder logged off and the fact that not all people will upload the same amount of data they downloaded as some will upload less and others will upload more. Ultimately, a perfect torrent would leave two end users with only a .50 ratio for the torrent, which means every user would have to provide new content at least equal to the portion of data they did not get to upload in the last torrent to maintain an overall ratio of 1.00.

While it's highly unlikely that all users who download a given torrent will achieve a 1.0 ratio on it (because the net ratio of all users is 1.0, if any user uploads past 1.0 some other user will have to sustain a lower ratio), it is more of a guideline to encourage the average upstream of a given network. Some networks, for example, prevent access to new torrents for the first 24-48 hours that the torrent is active to people with overall ratios of less than 1.0 and a certain amount of data uploaded.

The amount of time the client is left open may be more important than the amount of traffic contributed, since new users attempting to download a file will first need to find peers hosting the file.

Many advanced trackers now track statistics such as how many seeders and downloaders were on a torrent at the time of a user's disconnect as many consider this information more important than just the user's ratio of downloaded/uploaded.

For any more clarifications and doubts do mail me at : ajaykumar127@gmail.com


regards..
ajay

The Day Vista came onto my PC












It was not so long that i saw my new vista coming back to life.
All i remember is it was a lazy afternoon in the mid of my holidays after the 5th
semester @ college , and it's like this new thing is just come to my mind. So i decided to give it a try .As you might have seen the screen shot above from my desktop , i hereby want to write say about 10 features which i liked in Vista the most , here they go :

Top 10 Favorite New Features

From the core to the cosmetic, there's a lot to like in Vista.

1. Improved security. Running as a standard user with limited permissions is finally practical. With User Account Control, even administrators operate with reduced-privilege credentials and have to verify attempts to "escalate"—in other words, to execute commands that could expose the OS to danger.

2. New Start menu. With integrated search, you can type in a path—such as C:\Users\John—to launch Windows Explorer there, or simply start typing in a program or filename.

3. Internet Explorer 7. It may not be as good as Firefox or Opera, but it's a big improvement over IE6. Sure, we groused about the lack of tabs—but they're finally here.

4. New Windows Explorer. Explorer makes file navigation easier, with breadcrumbs that let you jump to a specific level in the directory hierarchy, integrated search, live icons that show both a visual preview of a document and the app that it opens in, and buttons that make it easy to perform common context-­appropriate tasks.

5 .Live views of application windows. Press Windows-Tab to get this "Flip 3D" view, or Alt-Tab for a 2D view. Either way, task switching is clearer.

6. Faster, image-based installation process.

7. Improved backup, including full-disk imaging.

8. Ad hoc collaboration with Windows Meeting Space.

9. Mobility Center, it's the Best bet!!

10. New Reliability and Performance Monitor, Task Scheduler, and Event Logs

so just go and grab you copy!!!!

Invisibility Cloaks Working



Optical-camouflage technology developed at the University of Tokyo

This seems perfectly believable when you're reading about a fictional world filled with witches, wizards and centuries-old magic; but in the real world, such a garment would be impossible, right? Not so fast. With optical-camouflage technology developed by scientists at the University of Tokyo, the invisibility cloak is already a reality.

Optical camouflage delivers a similar experience to Harry Potter's invisibility cloak, but using it requires a slightly more complicated arrangement. First, the person who wants to be invisible (let's call her Person A) dons a garment that resembles a hooded raincoat. The garment is made of a special material that we'll examine more closely in a moment. Next, an observer (Person B) stands before Person A at a specific location. At that location, instead of seeing Person A wearing a hooded raincoat, Person B sees right through the cloak, making Person A appear to be invisible. The photograph on the right below shows you what Person B would see. If Person B were viewing from a slightly different location, he would simply see Person A wearing a silver garment (left photograph below).

So What is Optical Camouflage?

Optical camouflage is a kind of active camouflage.

This idea is very simple. If you project background image onto the masked object, you can observe the masked object just as if it were virtually transparent.

This shows the principle of the optical camouflage using X'tal Vision. You can select camouflaged object to cover with retroreflector. Moreover, to project a stereoscopic image, the observer looks at the masking object more transparent.

Optical camouflage can be applied for a real scene. In the case of a real scene, a photograph of the scene is taken from the operatorfs viewpoint, and this photograph is projected to exactly the same place as the original. Actually, applying HMP-based optical camouflage to a real scene requires image-based rendering techniques.

though this technology appears as a remarkable invention this can easily misused.however we all are looking forward to buy this piece of clothing.......

regards..
ajay

War of Web Browsers

By now, we know that many of you are au courant with the uber-browsers available. Which is the best beta browser to choose is still a question mark.

Version 7.0 of internet explorer has just been unveiled by Microsoft Corp. for Windows XP and boasts of enhanced security features, making everyday tasks easier.

Talking about IE 7, Dean Hachamovitch, general manager, Internet Explorer team, Microsoft, said, "We listened carefully to our customers, and are delivering a safer browser that makes the tasks they do every day much easier."

The security framework of the new explorer has been overhauled, and as a result of these enhancements, the browser will be a stand-alone application, rather than integrated with the Windows shell, and it will no longer be capable of acting as a file browser.

IE7 in Windows Vista contains additional security measures, most significantly ‘Protected Mode’, whereby the browser runs in a sandbox. As such, it can write to only the Temporary Internet Files folder and cannot install start-up programs or change any configuration of the operating system without communicating through a broker process. This increases the security of the system considerably.

The ‘Protected Mode’ operation will not be included in the Windows XP version of Internet Explorer 7, as it relies on technologies not found on systems before Vista. It also supports the Parental Controls and Network Diagnostics features which are unique to Vista.

The security level of IE7 is vaunted to be high, but other browsers like Firefox, Safari, Netscape and Opera too vaunt of additional features and better security.

Mozilla Firefox, a free open source, cross-platform, graphical web browser developed by the Mozilla Corporation and hundreds of volunteers, has a spontaneous interface and blocks viruses, spyware, and popup ads.

The main features included with Firefox are tabbed browsing, incremental find, live bookmarking, a customizable download manager and a built-in search toolbar.

The new version of Firefox boasts of automatically upgrading the latest security and feature updates.

Safari, on the other hand, is a web browser developed by Apple Computer, Inc. and is available as part of Mac OS X. It was included as the default browser in Mac OS X v10.3 (Panther) and is the only browser bundled with Mac OS X v10.4 (Tiger).

Safari 2.0.4, the latest version, was released on June 27, 2006, and is packed with Apple's brushed metal user interface and has a bookmark management scheme that functions like the iTunes jukebox software. It also integrates Apple's QuickTime multimedia technology and features a tabbed-browsing interface similar to that of Firefox and Opera. The browser also includes an integrated pop-up ad blocker and a configurable image blocker.

Opera 9, developed by Opera Software, is the latest version unmasked on September 21, 2006. There are several new features in Opera 9. The most important ones are: Simple BitTorrent client, targeted towards novice users, content blocker (also known as AdBlock), thumbnail preview of tabs, site specific preferences (pop-up blocking, cookies, scripts, user style sheets, user-agent masking), the ability to create search engines from a textfield, improved rich text editing and redefined default hot keys to be more like Internet Explorer.

Netscape Communications Corporation(commonly known as Netscape), an American computer services company, best known for its web browser, was once dominant in terms of usage share, but lost most of its share to Internet Explorer during the first browser war. As of 2006, the usage share of Netscape browsers is under 1% and falling.

The company existed only from 1994 to 2003, latterly as a subsidiary of AOL, but the Netscape brand is still in use. In June 2006, Netscape redesigned their website to a totally different format which was similar to Digg. Users can vote for which stories are to be included on the front page, and may comment on them as well. Netscape's market share had been declining for over a year at the time of the change-over.

The current version of Netscape was released to mixed reactions. Some users really like that users had more participation ability, while others found the pages to be harder to navigate and not as structured. In fact, soon after the release of the new site, a story entitled ‘Netscape's Blunder’ was the top rated story.

As of July 2006, estimates suggest that Firefox's usage share is around 12% of overall browser usage, with its highest usage in Germany (about 39%). The usage data gives Opera's overall global share of the browser market as being between 0.5% and 1.0%, although Opera's usage share is over 11% in Ukraine, over 8% in Russia, over 7% in Poland and over 6% in Lithuania.

Safari’s global share has been climbing ever since its release, but is still below 5%.

The adoption rate of Internet Explorer seems to be closely related to that of Microsoft Windows, as it is the default web browser that comes with Windows. Since the integration of Internet Explorer 2.0 with Windows 95 OSR 1 in 1996, and especially after version 4.0's release, the adoption was greatly accelerated: from below 20% in 1996 to about 40% in 1998 and over 80% in 2000.

Internet Explorer had almost completely superseded its main rival Netscape and dominated the market.

After having fought and won the browser wars of the late 1990s, Internet Explorer began to see its usage share shrink. Having attained a peak of about 96% in 2002, it has since been in a steady decline, likely due to the rapid adoption of Mozilla Firefox, which statistics indicate is the current most significant competitor.

Nevertheless, Internet Explorer remains the dominant web browser, with a global usage share of around 85%. Usage is higher in Asia and lower in Europe.

regards..

ajay

Do you Want secure your to secure Windows2000 / XP to the max....then follow these basic steps [:)]

IMPORTANT INFORMATION REGARDING WINDOWSXP SP2 Some security softwares have had problems with Service Pack 2, like for example ZoneAlarm and some antivirus software. Also, there has been other issues regarding the SP2, I have personally found out that after installing it my computer stops working properly, I have not yet managed to solve the situation. Also, the SP2 has some changes regarding the settings of Internet Explorer, Windows ICF and other issues, so this page is not updated to meet SP2 details for now. My suggestion regarding SP2 is, that you should backup and try it out. If it works, fine, Microsoft has fixed some major security issues with it so you likely safe enought for now on default install on SP2 if you follow its security center guides. If you cannot install SP2 or get it working, then restore the old WindowsXP and use the settings and tips in this page as it is. Try later to install SP2 when Microsoft either fixes its bugs or we can discover some way to counter them.

These settings can be used with both Windows 2000 and WindowsXP to *really* secure the system and also boost up its performance. Depending upon your version and whether it is Win2k or XP, you might notice that some of the features/options arent there. Just skip and move on until you hit something that IS on YOUR Windows2k/XP. The "best" option of all is to have WindowsXP professional, since the screenshots are from WindowsXP professional. However, please notice that you can access some of the features in WindowsXP professional even if you are installing home edition, by booting into "Safe Mode" some time.

WindowsXP offers pretty good security features, but only if you know how to use them. By default, WindowsXP is clumsy and has many possible security holes due to its poor default settings. If you use WindowsXP pro, you can really make your computer your fortress against almost any invader. The build-in EFS (Encrypting File System with NTFS), strong authentication methods, firewall, etc. give you good tools for it. Home edition does not have all these features but you can always implement your own according to these guidelines. These principles are designed for ONLY single-user "home" computers (standalone), NOT computers in, lets say, corporate networks! On standalone computers you can and should fill all holes possible but in corporate enviroment, the whole point is to allow computers to be used via corporate networks or intranet. You can still take suggestions and clues here and implement them properly if you are installing or using Windows2k/XP in corporate enviroment or are using multiple user accounts.

Please remember!
As sayed earlier, these settings work like dream for me and most 2k / XP users too, but not with all of them. The best option would be to either make and "image" of your C-drive or write down your original settings before you start implementing these settings. The problems that might occur are mostly related to network connections / internet access. You can also troubleshoot the problems using the Windows Help and Support while going throught the settings to see what needs perhaps to be enabled. And if the worst happens...And you just cant revert the changes you made, run "repair install" using your Win2k/XP cdrom. It will keep all the programs etc. but restore regular settings. Remember to update and patch your software after this "repair install".

When you do some alterations to settings, make sure you exit that window by pressing OK or YES keys. If you simply close the window clicking from the X in the corner of it or press CANCEL, the alterations you just made will NOT become affective!

Two good links related to securing and tweaking Windows 2000 and Windows XP
Black Viper's guide on Windows 2000 and XP services
NSA security guides on securing WindowsNT, 2000 and XP (in corporate/network enviroment)

Before installing Windows 2000 / XP
-> Physically disconnect from the net!
- -> Do NOT plug the network cable/internet connection!

-> Backup all your personal files and documents to different HDD or partition
--> Optionally back up to CDRW or external HDD

During installation of Windows 2000 / XP
-> Delete old system partition(s), install from "fresh"!
--> Its a good idea to create atleast two partitions, one for the system (you need atleast 5 Gb for this one, but 10-20 Gb is better) and second for your own files and images from first partition (rest of the HDD space, but atleast double the amount of what is the size of first partition, so atleast 10, but 20-40 Gb is better). Ofcourse, if you have backed up your data to some other partition than C:, then do NOT remove or format that partition or your backups will be lost!
---> Format partitions to NTFS.

-> Create one account for yourself (besides the default "administrator account" there already is). This account does not have password by default.

-> Use good passphrases, atleast 14 marks long, containing both letters, numbers and special marks (like !"#¤%&/().). To be ultra-secure, use over 28 marks long Administrator passphrases.
--> Never use the same passphrase in two places/systems

After installation is done
-> When logging in first time when "Welcome" screen appears
--> Press ctrl+alt+del (couple times in row perhaps)
---> Login as Administrator and with administrator passphrase

Try to close all ports and shares
-> Control Panel
--> Network and Internet connections
---> Network connections
----> Select connections and right click on them
-----> Properties
------> Select all other items (one by one) than: TCP/IP
-------> Uninstall
------> Select: TCP/IP
-------> Properties
--------> Advanced
---------> WINS
----------> Remove: Enable LMhosts lookup
----------> Select: Disable Netbios over TCP/IP
---> Repeat the procedure on all other connections too

-> Control panel
--> Performance and maintenance
---> Administrative tools
----> Computer management
-----> Shared folders
------> Shares
-------> (delete everything inside)

-> (WindowsXP ONLY) Run: regedit.exe
--> Go to (if key/value does not exist, create one by right clicking in the right window)
---> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
----> EnableDCOM (REG_SZ)
-----> Set to: N
---> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc
----> Value: DCOM Protocols
-----> Remove ncacn_ip_tcp
---> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\
----> Value: MaxCachedSockets (REG_DWORD)
-----> Set to: 0
---> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
----> SmbDeviceEnabled (REG_DWORD)
-----> Set to: 0
---> HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters\
----> REG_DWORD
-----> AutoShareServer
------> Set to: 0
-----> AutoShareWks
------> Set to: 0
---> HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSession Pipes\
----> NullSessionPipes
-----> (Delete all value data INSIDE this key)
----> NullSessionShares
-----> (Delete all value data INSIDE this key)
---> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths\
----> Machine
-----> (Delete all value data INSIDE this key)

Enable Windows XP internet connection firewall (ICF)
-> Control Panel
--> Network and internet connections
---> Network connections
----> Select connection and right click on them
-----> Properties
------> Advanced
-------> Internet Connection Firewall (enable it)
--------> Settings
---------> Make sure NOTHING is selected/enabled
----> Repeat the procedure on all other connections too

Secure your Internet Explorer settings
-> Control Panel
--> Network and Internet connections
---> Internet Options
----> General
-----> Temporary internet files
------> Settings
-------> Set to: Every visit to page
-----> Days to keep pages in history
------> Set to: 0
----> Security
-----> Internet
------> Custom level
-------> Reset to: High
--------> Reset (yes)
------> Scroll down to "File download"
-------> Set to: Enable (yes) (THAT IS, IF YOU WANT USERS TO BE ABLE TO DOWNLOAD FILES FROM THE INTERNET!)
-----> Local intranet
------> Sites
-------> Make sure nothing is selected!
-----> Trusted sites
------> Sites
-------> Add this web site to the zone:
--------> Add all the domains here you can absolutely trust here (and press add after each domain)
---------> For example, add: *.microsoft.com
---------> For example, add: *.passport.com
---------> For example, add: *.msn.com
---------> For example, add: *.markusjansson.net
--------> Make sure "require server verification..." is not selected!
------> Move the tab to "Medium"
-----> Restricted Sites
------> Custom level
-------> Reset to: High
--------> Reset (yes)
------> Scroll down to "File download"
-------> Set to: Enable (yes)
----> Privacy
-----> Advanced
------> Override automatic cookie handling
-------> First party cookies: Block
-------> Third-party cookies: Block
-------> Enable: Always allow session cookies
----> Content
-----> Autocomplete
------> Disable all
------> Clear forms (yes)
------> Clear passwords (yes)
------> Programs
------> Disable: Internet Explorer should check whether it is the default web browser
----> Advanced
-----> Disable everything else, but enable the following
+ Always send URL:s as UTF-8
+ Disable script debugging
+ Enable folder view on FTP sites
+ Enable page transitions
+ Show friendly http error messages
+ Show go button in address bar
+ Use passive ftp
+ Use smooth scrolling
+ Use http 1.1
+ Use http 1.1 through proxy connections
+ Dont display online media content in the media bar
+ Play animations in webpages
+ Play sounds in webpages
+ Play videos in webpages
+ Show pictures
+ Smart image dithering
+ Check for publishers certificate revocation
+ Check for server certificate revocation
+ Check signatures on downloaded programs
+ Do not save encrypted pages to disk
+ Use SSL 3.0
+ Use TLS 1.0
+ Warn about invalid site certificates
+ Warn if form submittal is being redirected

Turn Telnet NTLM logings off
-> Run: telnet.exe
--> Type (and press enter): unset ntlm

Turn SYSKEY on
-> Run: syskey.exe
--> Encryption enabled
---> Update
----> Store key locally

Turn extra accounts off
-> Control Panel
--> Performance and maintenance
---> Administrator tools
----> Computer management
-----> Local Users and groups
------> Local Users
-------> Delete all users other than "Administrator" and "Guest" and the user accounts you specially have created.

Create/edit user level accounts
-> Run: control userpasswords2
--> Here you can easily add, remove and edit existing accounts. Ideal composition is that you have administrator account and one user account per every user who uses your computer (and they all are protected by good passwords). If you didn't create a user level account during setup, you can easily change one of the accounts here from "administrators group" to "user".
--> Enable: Users must enter a user name and password to use this computer
--> After installing, you usually have TWO accounts that are in administrator group. One that is "administrator" and other that is account in administrators group (named as you named it during Windows XP installation).
---> Select the latter account
----> Properties
-----> Group membership
------> Set to "Restricted User"
----> Reset password
-----> Set the password what you desire, but do not use the same password as you used with your administrator account

Turn safer login on
-> Control Panel
--> User Accounts
---> Change the way users login
----> Disable: Use welcome screen

-> Run: regedit.exe
--> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
---> DefaultPassword
----> (Delete this KEY if present)

Optionally) Create password reset diskettes
-> Control Panel
--> User Accounts
---> Click onto account you want to create password reset diskette to
----> Related tasks
-----> Prevent a forgotten password, etc.
------> Keep that diskette in SAFE place!

Close all not-needed services
-> Control Panel
--> Performance and maintenance
---> Administrative tools
----> Services
-----> Go to every service EXCEPT
+ Application Layer Gateway Service
+ Application Management
+ Automatic Updates
+ Backround Intelligent Transfer Service
+ Cryptographic Services
+ DHCP Client
+ Event Log
+ Help and support
+ Human Interface Device Access
+ Internet Connection Firewall
+ Network Connections
+ Network Location Awareness (NLA)
+ Plug and Play
+ Print Spooler (if you have printers)
+ Remote Access Connection Manager
+ Remote Procedure Call (RPC)
+ System Event Notification
+ Task Scheduler
+ Telephony
+ Themes (hey, you dont want to shutdown cute themes right?)
+ Windows Audio
+ Windows Image Acquisition (if you have scanners or digital cameras attached)
+ Windows Installer
+ Windows Management Instrumentation
+ Windows Management Instrumentation Driver Extensions
------> Doubleclick with left mouse button or click right mouse button and select "Properties"
-------> Startup type
--------> Set to: Disabled
-----> Go to
+ Automatic Updates
------> Startup type
-------> Set to: Automatic

Prevent not-needed programs from starting up
-> Run: msconfig.exe
--> Startup
---> Unselect all (unless you KNOW that there is some specific program launching up that you need, for example third party application for your printer, xDSL connection or similiar).
----> If you are unsure, still unselect all. You can later come back and re-select some if it was important

Secure settings
-> Control panel
--> Performance and maintenance
---> Administrative tools
----> Local security policy
-----> Account policies
------> Password policy
------> Enforce password history - 0 passwords remembered
------> Maximum password age - 360 days
------> Minimum password age - 0 days
------> Minimum password lenght - 14 characters
------> Password must meet complexity requirements - Enabled
------> Store passwords using reversible encryption for all users in the domain - Disable
-----> Account lockout policy
------> Account lockout threshold - 3 invalid logon attempts.
------> Account lockout duration - 15 minutes
------> Reset account lockout counter after - 15 minutes
-----> Local policies
------> Audit policy
-------> Audit account logon events - Success, failure
-------> Audit account management - Success, failure
-------> Audit logon events - Success, failure
-------> Audit Object access - Success, failure
-------> Audit policy change - Success, failure
-------> Audit system events - Success, failure
------> User rights assignment
-------> Access this computer from the network -
-------> Act as part of the operating system -
-------> Add workstations to domain -
-------> Adjust memory quotas for a process - LOCAL SERVICE,NETWORK SERVICE,Administrators
-------> Allow logon through Terminal Services -
-------> Back up files and directories - Administrators
-------> Bypass traverse checking - Authenticated Users,Administrators
-------> Change the system time - Administrators
-------> Create a pagefile - Administrators
-------> Create a token object -
-------> Create permanent shared objects -
-------> Debug programs - Administrators
-------> Deny access to this computer from the network - Everyone
-------> Deny logon as a batch job -
-------> Deny logon as a service -
-------> Deny logon locally -
-------> Deny logon through Terminal Services - Everyone
-------> Enable computer and user accounts to be trusted for delegation -
-------> Force shutdown from a remote system -
-------> Generate security audits - LOCAL SERVICE,NETWORK SERVICE
-------> Increase scheduling priority - Administrators
-------> Load and unload device drivers - Administrators
-------> Lock pages in memory - LOCAL SERVICE, Authenticated Users,Administrators
-------> Log on as a batch job -
-------> Log on as a service -
-------> Log on locally - Authenticated Users, Administrators
-------> Manage auditing and security log - Administrators
-------> Modify firmware environment values - Administrators
-------> Perform volume maintenance tasks - Administrators
-------> Profile single process -
-------> Profile system performance -
-------> Remove computer from docking station - Authenticated Users,Administrators
-------> Replace a process level token - LOCAL SERVICE
-------> Restore files and directories - Administrators
-------> Shut down the system - Authenticated Users, Administrators
-------> Synchronize directory service data -
-------> Take ownership of files or other objects - Administrators
------> Security options
-------> Accounts: Administrator account status - Enabled
-------> Accounts: Guest account status - Disabled
-------> Accounts: Limit local account use of blank passwords to console logon only - Enabled
-------> Accounts: Rename administrator account - (TYPE SOME NAME HERE AND USE IT WHEN YOU LOGIN AS ADMINISTRATOR IN THE FUTURE)
-------> Accounts: Rename guest account - Guest
-------> Audit: Audit the access of global system objects - Disabled
-------> Audit: Audit the use of Backup and Restore privilege - Disabled
-------> Audit: Shut down system immediately if unable to log security audits - Disabled
-------> Devices: Allow undock without having to log on - Disabled
-------> Devices: Allowed to format and eject removable media - Administrators
-------> Devices: Prevent users from installing printer drivers - Enabled
-------> Devices: Restrict CD-ROM access to locally logged-on user only - Enabled
-------> Devices: Restrict floppy access to locally logged-on user only - Enabled
-------> Devices: Unsigned driver installation behavior - DO not allow installation
-------> Domain controller: Allow server operators to schedule tasks - Disabled
-------> Domain controller: LDAP server signing requirements - Not defined
-------> Domain controller: Refuse machine account password changes - Enabled
-------> Domain member: Digitally encrypt or sign secure channel data (always) - Enabled
-------> Domain member: Digitally encrypt secure channel data (when possible) - Enabled
-------> Domain member: Digitally sign secure channel data (when possible) - Enabled
-------> Domain member: Disable machine account password changes - Enabled
-------> Domain member: Maximum machine account password age - 1
-------> Domain member: Require strong (Windows 2000 or later) session key - Enabled
-------> Interactive logon: Do not display last user name - Enabled
-------> Interactive logon: Do not require CTRL+ALT+DEL - Disabled
-------> Interactive logon: Message text for users attempting to log on -
-------> Interactive logon: Message title for users attempting to log on -
-------> Interactive logon: Number of previous logons to cache (in case domain controller is not vailable) - 0 logons
-------> Interactive logon: Prompt user to change password before expiration - 14 days
-------> Interactive logon: Require Domain Controller authentication to unlock workstation - Enabled
-------> Interactive logon: Smart card removal behavior - Lock Workstation
-------> Microsoft network client: Digitally sign communications (always) - Enabled
-------> Microsoft network client: Digitally sign communications (if server agrees) - Enabled
-------> Microsoft network client: Send unencrypted password to third-party SMB servers - Disabled
-------> Microsoft network server: Amount of idle time required before suspending session - 1
-------> Microsoft network server: Digitally sign communications (always) - Enabled
-------> Microsoft network server: Digitally sign communications (if client agrees) - Enabled
-------> Microsoft network server: Disconnect clients when logon hours expire - Enabled
-------> Network access: Allow anonymous SID/Name translation - Disabled
-------> Network access: Do not allow anonymous enumeration of SAM accounts - Enabled
-------> Network access: Do not allow anonymous enumeration of SAM accounts and shares - Enabled
-------> Network access: Do not allow storage of credentials or .NET Passports for network authentication - Enabled
-------> Network access: Let Everyone permissions apply to anonymous users - Disabled
-------> Network access: Named Pipes that can be accessed anonymously -
-------> Network access: Remotely accessible registry paths -
-------> Network access: Shares that can be accessed anonymously -
-------> Network access: Sharing and security model for local accounts - Classic local users authenticate as themselves
-------> Network security: Do not store LAN Manager hash value on next password change - Enabled
-------> Network security: Force logoff when logon hours expire - Disabled
-------> Network security: LAN Manager authentication level - Send NTLMv2 response only\refuse LM & NTLM
-------> Network security: LDAP client signing requirements - Require signing
-------> Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - Require message integrity,Require message confidentiality,Require NTLMv2 session security,Require 128-bit encryption
-------> Network security: Minimum session security for NTLM SSP based (including secure RPC) servers - Require message integrity,Require message confidentiality,Require NTLMv2 session security,Require 128-bit encryption
-------> Recovery console: Allow automatic administrative logon - Disabled
-------> Recovery console: Allow floppy copy and access to all drives and all folders - Disabled
-------> Shutdown: Allow system to be shut down without having to log on - Disabled
-------> Shutdown: Clear virtual memory pagefile - Enabled
-------> System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing - Enabled
-------> System objects: Default owner for objects created by members of the Administrators group - Object creator
-------> System objects: Require case insensitivity for non-Windows subsystems - Enabled
-------> System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) - Enabled

Secure various other settings
-> Control Panel
--> Appearance and Themes
---> Display
----> Screen Saver
-----> Set to: Blank
-----> Set to: Wait 15 minutes
-----> Enable: On resume, password protect
---> Folder options
----> View
-----> Make sure the following are enabled:
+ Display the content of system folders
+ Display full address in address bar
+ Show hidden files and folders
+ Show encrypted and compressed NTFS files in color
-----> Make sure the following are NOT enabled:
+ Automatically search for network folders and printers
+ Hide extension of known file types
+ Hide protected operating system files
+ Restore previous folder windows at logon
+ Use simple sharing
--> Performance and maintenance
---> System properties
----> Advanced
-----> Performance - Settings
------> Advanced
-------> Virtual memory
--------> If you have plenty or RAM (lets say 512MB or more), you can disable Windows Swapfile. This will increase performance and security, since no sensitive data can be written on the hdd (swapfile) in any situation. If you dont have that much RAM, in theory it is good idea to have fixed size swap file, lets say 256 or 512MB.
---------> Select each partition and "No paging file" (or set it as fixed on one partition if you dont have 512MB or more RAM)
-----> Startup and recovery - Settings
------> System failure
-------> Unselect all
-------> Write debugging information
--------> None
-----> Error reporting
------> Select: Disable error reporting, but notify me when critical errors occur
----> Automatic Updates
-----> Enable: Keep my computer up to date
-----> Select: Download the updates automatically and notify me when they are ready to be installed
----> Remote
-----> Unselect: Remote Assistance
-----> Uselect: Remote Desktop
---> Power Options
----> Hibernate
-----> Disable: Enable Hibernation

-> Run: mmc.exe
--> File
---> Add/Remove snap-in
----> Add
-----> Select: Group policy
------> Finish/Close/OK
--> Local Computer Policy
---> Computer configuration
----> Administrative Templates
-----> Windows Components
------> Netmeeting
-------> Disable remote desktop sharing - Enabled
-----> System
------> User profiles
-------> Only allow local user profiles - Enabled
------> Remote assistance
-------> Solicited remote assistance - Disabled
-------> Offer remote assistance - Disabled
------> Turn off autoplay - Enabled (all drives)
------> Network
-------> Offline Files
--------> Allow or disallow use of the Offline Files feature - Disabled
-> Notice that you can use this group policy tool to restric users from altering all kinds of settings in your computer. For example, you could set up Internet Explorer settings very secure (and prevent downloading of files), and then prevent users from altering those settings. This is excellent tool when you learn to use it properly.

Adjust event viewer settings
-> Control Panel
--> Performance and maintenance
---> Administrative tools
----> Event viewer
-----> Right click: Application
------> Properties
-------> Maximum log size: 10048
-------> Select: OVerwrite events as needed
-----> Right click: Security
------> Properties
-------> Maximum log size: 10048
--------> Select: Overwrite events as needed
-----> Right click: System
------> Properties
-------> Maximum log size: 10048
--------> Select: Overwrite events as needed

Secure file and folder permissions
-> My Computer
--> Right click on your mouse to C:\
---> Properties
----> General
-----> Disable: Allow indexing service to index this disk for fast file searching
----> Security
-----> Add
------> Type: Authenticated Users
-------> Press enter
-----> Select: Authenticated Users
------> Allow: Read & Execute, List folder content, Read
-----> Advanced
------> Unselect: Inherent from parent permission entries...
-------> Copy
------> Remove all other users except: Administrator, System and Authenticated Users
-------> Select: Replace permissions entries...
--------> OK
---------> Yes
--> Go to C:\documents and settings\
---> Right click on your mouse to Administrator folder
----> Properties
-----> Security
------> Advanced
-------> Unselect: Inherent from parent permission entries...
--------> Copy
---------> Remove: Authenticated Users
----------> Select: Replace permission entries...
-----------> OK
------------> Yes
---> Right click on your mouse to, one at the time, all other user folders (like "mom", "userX", etc.)
----> Properties
-----> Security
------> Advanced
-------> Unselect: Inherent parent permission entries
--------> Copy
--------> Remove: Authenticated users
---------> Add that users name (like "mom", "userX", etc.) who's folders these are. This will prevent all other users except admins from getting into their folders.
----------> Allow: Full Control
---------> Select: Replace permission entries...
----------> OK
-----------> Yes
--> Go to C:\windows (or if your Windows is installed onto some other directory, then go there)
---> Select "temp" folder
----> Properties
-----> Security
------> Select: Authenticated Users
-------> Allow: Full Control
--> You can also set permissions like this in other partitions and folders. Please be adviced, that if you store something like games in somewhere, users who need to play those games need to have, usually, full control on those folders so that they can save games etc. Same goes if you store other files in those partitions, like music, documents etc. that other people want to not only access, but also save and edit. Then you should give "Authenticated Users" full permissions on those folders. The main thing is, that your personal folders (C:\documents and settings\userX\) are safe from other peoples tampering and so are important system folders (C:\windows\).

-> To encrypt (EFS) the content of directories and prevent all other users (including administrators) from reading the content of files inside (only in XP pro version) the directory (notice: they can still see the file names and alter folder settings)
-> Only use this for YOUR personal directories (like to folders where you keep personal documents etc.), do not use on system, program, etc. directories!
--> Right click on your mouse to the directory you wish to encrypt
---> Properties
----> General
-----> Advanced
------> Enable: Encrypt the contents to secure data (notice: If you are logged in as administrator, this will encrypt the data for administrator account only. To encrypt data for your USER account, please secure you WindowsXP installation, login as user and then start encrypting your folders)

(Optionally) Export your EFS certificate
-> Make sure you have encrypted some directory with the user that you wish to export the EFS certificate from (otherwise you dont have EFS certificate which to export)
-> Run: MMC
--> File
---> Add/Remove Snap-in
----> Add
-----> Select: Certificates
------> Add
-------> Select: My user account
--------> Finish/close/OK
--> Certificates - Current User
---> Personal
----> Certificates
-----> Select your certificate from the right window
------> Right click with your mouse
-------> All tasks - Export
--------> Next
---------> Select: Yes, export the private
----------> Next
-----------> Write a passphrase to protect the certificate and remember it!
------------> Choose where and under what name to export it
-------------> Next, etc. etc.

Reboot your computer
-> If/When "Welcome" screen appears
--> Press ctrl+alt+del (couple times in row perhaps)
---> Login as (WHATEVER NAME YOU RENAMED THE ADMINISTRATOR ACCOUNT AS) and with administrator passphrase

Now you can physically connect to internet!
-> Plug in the network cable etc.
--> Set whatever settings needed to make it possible for you to connect to internet.

Update Windows
-> Go to http://windowsupdate.microsoft.com
--> Download ALL updates available
---> Reboot when asked to administrator account again
----> Return to this site to download more and more and more patches
-----> Continue to download/install patches, rebooting and returning to this page until you have downloaded ALL patches and cannot download any more patches.
-> Remember to come back to see new patches hopefully every week but atleast once a month! We have set automatic Windowsupdate, but I STILL insist that you recheck for ANY new updates every once and while. Just to be sure. Updating your Windows, Windows Media Player, Internet Explorer, Outlook Express etc. is REALLY THAT IMPORTANT!

And finally...
-> Go throught this list AGAIN, since so might have missed something, or some updates/patches might have changed some settings, for example downloading Windows Messenger update automatically changes your ICF setting (!!!), opening few ports on your system!
-> When you are done installing, updating and securing your Windows XP, login as USER with the passphrase you resetted it to previously. Only use ADMINISTRATOR account/permissions when you REALLY need to install/update/modify some settings. Logging in as administrator permissions is severe security risk and it should be avoided at all costs.
--> Remember to change the password in all new account when you login for the first time. By default, new accounts have NO password set. Press Ctrl+Alt+Del and Change Password to change your password.

Regards....

TheSolutionProvider

for all those people who want to enjoy windows environment but still want to install linux.... U can use VMWARE.....

first of all thanks to my Best Friend Jagtesh singh Chadda (Jaggu) who enlightened me on this topic...

VMWare runs Windows inside Linux, and it works ...very well too


If you switch to Linux and get rid of Windows, your computer will run without crashing and will be immune to all the problems that plague Windows. But let's be real. You'll have another set of problems to deal with.

You won't be able to run any of your Windows software. You won't be able to run Microsoft Money or Quicken. You won't be able to run Microsoft Word or Excel, or any of the thousands of other good Windows programs.

You'll have a lot of good Linux software to choose from, but sometimes there is no substitute for the stuff you're used to.

An easy way around this is to create a dual-boot PC. When you install most modern versions of Linux, you can set aside space on your hard drive for Linux while keeping everything the way it is for Windows. When your PC boots up, you can choose one or the other. That way, you can reboot when running Linux and come up running Windows. This is ideal for anyone who plays a lot of Windows games, because Windows is a wonderful operating system for games.

But a dual-boot PC won't let you run Windows programs while you're running Linux. To do that, you need VMWare.

VMWare, from a California company with the same name, lets you run the entire Windows operating system inside a window on your Linux PC. While your PC is running Linux, you can click over to your Windows desktop and work in Excel or check your finances with Microsoft Money. You can run Outlook Express or Family Tree Maker or any other Windows program. You can do this while continuing to run all your Linux software, too. Windows becomes just another program in Linux.

After running VMWare for many weeks on my main Linux PC, I'm convinced it's about as close as you can come to a miracle this side of Heaven. It ran every normal Windows program I installed -- I didn't try any major games, but I ran all my standard software -- and VMWare hardly slowed down my Linux PC at all.

You'd probably think I'm exaggerating when I describe what VMWare does, so let me give you a short list.

VMWare:

-- Can run many copies of Windows on one PC, all while Linux is doing its normal functions, without requiring a reboot. In other words, you could have Windows 98 and Windows 2000 running separately from each other in your Linux PC.

-- Keeps the Windows operating system and all Windows programs isolated from Linux. A crash in Windows has no effect on your PC.

-- Connects the Linux and Windows operating systems to each other by a virtual network within the PC. No networking card is needed.

-- Allows quick cut-and-paste operations between Windows and Linux.
VMWare costs $100 for individuals or $300 for businesses. You can download a free trial copy or find out more about VMWare from the company's Web site at http://vmware.com/ . The company also sells a version of VMWare that uses Windows NT or Windows 2000 as the host operating system, but I didn't try that version. (Because Windows is less stable than Linux and because Linux is free, I can't recommend the NT version of VMWare. If you want to run VMWare, install Linux first.)

VMWare works by creating one or more virtual machines (VMs) inside the Linux operating system. A virtual machine is something that acts just like a real thing -- in this case, a PC -- while not existing at all except as a software program. In VMWare, each virtual machine acts like a totally separate computer. These virtual machines can run any version of Windows -- from Windows 3.1 to Windows 2000 -- and they can also run other PC operating systems such as Linux or the PC version of Sun's Solaris.

VMWare could be described as a PC emulator or Windows emulator, but that's not what it is. PC emulators do all their work in software, but VMWare takes advantage of a function of the Intel computer-chip design that allows the creation of a virtual machine within the processor. The virtual computer VMWare creates uses the PC's peripherals and hardware directly, just as a normal PC would. Because of the advanced multitasking of Linux, VMWare is able to make Windows run smoothly without slowing down anything on the Linux side.

Your PC needs a lot of memory -- 128 megs is the minimum for normal operation, although 96 megabytes would be OK if you can't add more at the moment -- and it needs a fast processor. My experience running VMWare on my cousins 450 MHZ Pentium II showed that you need all the speed you can get. His processor actually runs at 464 MHZ (I turned up the speed slightly), but this didn't help boost VMWare much.

My guess is that a 500 MHZ Pentium III PC would give a virtual PC speed of 100 MHZ to 133 MHZ. If this seems to be a big loss in speed, keep in mind that all other operations on the Linux PC are unaffected. I saw no perceptible loss in the speed of most other operations in Linux when Windows 98 was running in VMWare.

...so give it a try

regards...
thesolutionprovider