Dual Boot Laptops

[Guest]

Our management recently made a decision to provide all laptop users with a
dual boot environment - one for our corporate XP Pro image, the other
configured as a Workgroup based system. The Workgroup based boot would be
used by users when they are connected to their home network (also configured
as a Workgroup environment). We have implemented a full locked down
environment for the Corporate image, using GPOs.

I would appreciate any feedback from the XP Security newsgroup as to what
issues we could see with this type of configuration and the potential
security issues with a dual boot configuration. For example, the users can
see both partitions and copy files between them.

Is there a tool and or utility that we could implement to hide the partition
that is not in use? I have asked IBM (our laptop vendor) for such a tool,
although they have not responded with a potential solution. We have also
considered using a separate hard disk, depending on what environment the user
wishes to access. The cost for such a solution on a ThinkPad laptop is
approximately $800 CDN, something that has been deemed unrealistic. We have
also looked at implementing VMWare Workstation as a potential solution,
although this will cost $257 CDN per laptop.

Any insight would be greatly appreciated....

Regards,

CanNear

 

[Mark Dormer]

You could use a boot manager to hide the other partition when an OS is
booted.
BootIt NG works well and is certainly a cheaper option than those you
mentioned
And you can try it out to see if it satisfies before purchasing
www.bootitng.com

Regards
Mark Dormer

 

[Steve Riley [MSFT]]

You might have a usability issue here and a certain amount of dissatisfaction.
Presumably, people will want to read corporate email and work on documents
when they're home -- but they won't be able to if the corporate partition
is inaccessible.

If your corporate image is already locked down, and by that I mean you're:

* not running as local admin
* have installed and enabled a host firewall
* are using continually-updated virus and spyware scanners
* perhaps even considering software restriction policies

then it might not be necessary to deal with a dual-image scenario.

Steve Riley
(e-mail address removed)