XP SP2 - Protected HOSTS file?

[ElijahBaley]

Hi

Does anyone know if Microsoft have implemented some sort of protection on the hosts file in SP2 after attacks from mydoom etc?

Can Windows resolve to windowsupdate.microsoft.com without DNS or a Host file entry? (is there a secret encrypted host file?)

All I want to do is disable DNS lookups an some standalone workstations but allow them to connect to windows update, symantec live update etc, I was hoping to do this through the hosts file, but any entries related to microsoft.com do not work!

Any advice appreciated,



..EB


"Smoke me a kipper, I'll be back for breakfast!"

"Captain A.J. Rimmer, Space Adventurer!"

 

[Zelandakh]

I can't use hosts to change windowsupdate but I can add in fictitious subdomains of MS.
Could be embedded to stop new hosts files redirecting - it would be sensible...

grope.microsoft.com now points to my firewall and resolves fine.

 

[ElijahBaley]

Thanks for your comments Zel

So if I disable DNS I can't get a connection to windows update.

I wonder if there is a reg entry that could be used to redirect to an IP address?



..EB


"Smoke me a kipper, I'll be back for breakfast!"

"Captain A.J. Rimmer, Space Adventurer!"

 

[ascotta]

If your DNS doesn't resolve the name to IP then it will be forwarded to your ISP then eventually to the A,B,C etc DNS servers etc.

If you disable DNS then there is no name to IP resolution unless you use WINS which is completly useless anyway.

We may have to think out of the box a wee bit for this one.

Would hosts not possibly be protected a la dll cache, might be worth a look. 9:00 pm and I am not doing it now.

Here is an initial thought. Create a New DNS server, that cannot forward requests to anywhere else, but have entries for windows updates and those and such as those you want them to get. Then point the limited clients at that.



[blue]Arguably the best cat skinner around ! [/blue]

Cheers
Scott

 

[ElijahBaley]

Cheers Scott

WINS is only for resolving NetBios names, so I do not think it comes into play in this scenario.

What I am trying to do is set up single standalone XP Pro machines which will use terminal services over a DSL connection for all services. I want to completely disable a local users ability to use the DSL connection for web browsing, while still allowing Symantec liveupdates and Microsoft Windows updates - I had thought this would be simple, until I discovered I could not make effective entries in the host file for any.microsoft.com

I agree with Zel, that it makes sense for MS to do this - however it does not help with my problem...





..EB


"Smoke me a kipper, I'll be back for breakfast!"

"Captain A.J. Rimmer, Space Adventurer!"

 

[ascotta]

Off the wall this one, replace the XP box with a winterm. No option but to go terminal services.

[blue]Arguably the best cat skinner around ! [/blue]

Cheers
Scott