SECURITY WATCH

Probably the scariest sensation in computing occurs when you realize that someone is trying to break in to your PC via a network. Fortunately, most of us won't experience this sensation any time soon; unfortunately, this is because there are darn few mechanisms built in to the typical PC to detect these activities.

This is particularly troublesome for mobile users, who frequently plug in to a variety of foreign networks. Most of us assume that these networks are owned and operated by upstanding corporate entities and that no one on such networks would dare attempt something as outrageous as breaking in to a personal system. This is, of course, a foolish assumption. The line between the large and unruly Internet and large and unruly corporate intranets is blurring every day. We've even seen trusting souls who join their laptop Windows NT Workstations to NT Server domains at customer sites; they sometimes receive unwanted attentions from rogue members of the Domain Admins group. (Don't forget, the act of joining your NT system to a domain automatically grants membership in the local Administrators group to members of Domain Admins.)

But you've got to plug in to get any useful work done. How do users make sure they aren't giving up the farm as well? We'll share with you some tips and tricks we've learned over the years while toting NT laptops around to various corporate sites. (And we apologize in advance to Linux and Windows 9x users, who won't find much help here.)

First of all, don't join any NT domains! There really should be no reason to do so; you can access all domain resources by manually entering the proper log-in credentials into the necessary applications. One catch-22 comes when a domain account expires. Typically, you would have to join the domain to change the password. With the neat little utility passwd by Alexander Frink, you can reset domain passwords from a command line -- without having to join the domain. (See wwwthep.physik.uni-mainz.de/~frink/nt.html.)

NT supplies a couple of rudimentary tools to monitor possible intrusions. Two of the best are netstat and nbtstat. The netstat -an command lists listening ports and established connections by numeric IP address and can show undesirables among these. The nbtstat -S command dumps the NetBIOS connection table, indicating any unwanted sessions.