NT4/2K/XP - clearing the pagefile at shutdown

[Kittie_Killer]

How secure an OS is depends upon certain features implemented, one feature being object reuse. Simple put, object reuse just means that objects (including disk blocks, memory and other shared resources) are cleared out after use. This prevents leakage of confidential data.

As shipped NT4 (2K/XP also ?) doesn't implement reuse on the virtual memory's pagefile. A couple of publicized attacks rely on the fact that NT's pagefile is left intact when the the system shuts down; it can then be scanned for useful data. To prevent this, add or modify the following registry entry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Control\SessionManager\Memory Management

REG_DWORD
ClearPageFileAtShutdown
Value = 1

This registry entry will force the system to zero out the contents of the pagefile at system shutdown.


note: as with any addition or modification to the registry - backup it up before !

(the above info can be verified in the following M$ Knowledge Base Articles: Q182086 and Q314834)

 

[Rapmaster]

In Win2k you can set this by going to Control Panel-->Administrative Tools--> Local Security Policy--> Local Policies --> Security Options and Enable "clear virtual memory pagefile when system shuts down"

(this probably just sets the registry entry you mentioned)