Window XP or How I Learned to Stop Worying and Follow Best Practices

The following is a story told by two people: myself and and a former superior who was also involved. This took place about a year and a half ago. This is the story the best we can recall.

Obligatory note that I did put this together on mobile. It was also written by two people so may be inconsistent.

My side of the story:

Cast: $Me: a student worker, on the job about a year and a half. I had more experience than most other student workers.

$FT: a full-time worker who I worked a lot with. Had been with the institution for several years and was quite skilled.

$CISO: the rather new Chief Information Security Officer, who has been with the institution only a few months. Very skilled individual though.

Setting: Deployment Room, with access restricted only to workers in technology such as $Me and $FT.

Act I: Near the End of the Week

In Deployment Room, there was a computer that was primarily used by student workers such as myself. Usually domain accounts would be used on it, but sometimes a local admin account would be used.

The computer's local admin account had been used by some other student worker help over the summer, and considering they were high schoolers, they had set the profile picture and wallpaper to something that I was just tired of looking at (I can't remember what) I was messing with it and it was a slow day, so I was playing around with the personalization settings. I thought it would be fun to set the wallpaper to Bliss, and the highlight color to a blue. I also set the profile picture to an XP one and even the lockscreen background to the XP lockscreen. $FT agreed it was pretty funny.

We went home for the weekend.

Act II: Monday

I get to work that Monday about Noon. My work schedule was Monday through Friday from Noon to 5, with the notable exception of Tuesday, where my class schedule allowed me to stay home. I had some other duties so it may have been around 1 or 2 before I actually got to the Deployment Room.

$FT: "Did you check out the XP machine?"

$Me: "No, I haven't. Did you do more tweaks?"

$FT: " Yeah, it's not perfect though."

I go to the computer and log in to the local admin account, and was quite impressed. $FT had used some UI mod applications to make the UI look and feel surprisingly similar to the XP interface, down to the Start menu and the taskbar, including the window borders.

We both have a good laugh at this.

I, however, had a few concerns. As one of my student worker tasks, I would also read EULAs and look for any red flags they might have. The institution was working on standardizing the software approval process, and this was an integral part of it. To put it simply, the software $FT used for this little joke had not gone through that process. I though about saying something, but didn't.

Act III: Wednesday

Cast: same as before, with one notable addition:

I walk into the Deployment Room and look at where the computer is supposed to be. It is gone.

$FT fills me in to the details of the previous day (my day off). I will not tell it all here as he tells it better below. In short, $CISO came investigating a problem (that he suspected was my fault) and was surprised to log in to Windows XP.

The funny thing was, the reason that the infosec people came in for was an entirely unrelated piece of software (equally unapproved) that we had been using to clone gard drives. It was making a ton of network requests. Had the UI for the local admin account not been modified, the explanation would likely have been much simpler.

Both $Me and $FT got talked to, and we learned our lesson. I think we were both spared any serious punishment. I couced regret that I didn't say something when I thought about it.

We both still have a good laugh at this.

The following is the same story, from the perspective of the full time person in my story. I have slightly edited it to make it a bit more anonymous. From here on, "I" refers to "$FT".

We have a computer in our deployment area that is the primary computer for any technician using the area. Since this machine was only generally used by tech staff it would be unusual for anyone outside of the tech department to see this computer. Some technicians like to make custom backgrounds for their user profile on the machine. During the summer this got a little out of hand.

Firstly, a group of teenagers hired on to help with tech related projects had access to this machine. They set several inappropriate backgrounds on the local administrator account. ($SW note: I do not recall that they were NSFW or anything, but they were definitely not professional) Part of their duties included use of the local admin account on our machines to be able to install and update certain programs. The decision to use the local admin account was to reduce the number of profiles loaded on to the machine before the machines went in to use. Eventually, with the machine used in our deployment area we required the teenagers to sign into the machine with their own accounts.

Sometime during one of our mass deployments we ran in to an issue where we found that the storage, we received from our vendor was incorrect. They had sent us HDDs instead of the SSDs we had paid for. The vendor tried to rectify this for us by sending us SSDs that we would need to swap out with the HDDs. Since most of the machines had been imaged at this point, we tried to find a way to clone the HDDs to the SSDs. One way, which was successful, was in the use of a software called Macrium Reflect that enabled us to clone the drives via software.

After the summer was over, we cleaned up the mess the teenagers had made of our area. Part of this was getting rid of the nonsense backgrounds on the local admin account on our technician computer. One of our technicians ($SW note: me) decided that it might be interesting to see if he could set a hi-res Windows XP background on the admin account. He also set the color accents on the account to match the XP color scheme.

This is where I come in, I saw what he was doing and I thought, "this is fun, we should see how far we can take this."

I am not sure if at this point, I found a lock screen, or he found the lock screen, but we found one to use on the local admin account. I think it may have stayed like this for a few days. One of my co-workers saw it and said they had a brief feeling PTSD from seeing the XP lock screen. That made it more fun for me. I decided that I would tweak the UI as much as I could and get it looking as much like XP as possible. One reason was because it was fun, the other being that I saw it as a challenge to see what I could do.

I ended up installing some 3rd-party software, not approved by our organization, to modify the ui. I changed the task bar and the windows, and I replaced all the icons in use. I also changed the Start menu, so it looked just like the XP Start Menu.

I couldn't wait to show my co-workers to see their reactions. The system stayed in this state for a few days.

One day, during lunch, I got a call from a member of our infrastructure team. They asked, "Hey do you know what computer ****** is?" I said that I did. I said, it is the computer we use int he deployment area.

They asked, "Is anyone using it right now?"

I got up and walked into the area to check, and no one was there using it.

So, I told them, "no, no one is using it."

They said, "Well, it is generating a lot of traffic, it is the number one destination on the network right now. Hang, on the security guys are going to go over to check it out."

I started to think, "oh crap, does this have something to do with the mods I made to the computer?"

When they arrived, they sat down at the computer and got the sign on screen which showed the last logged in user.

They asked, "Who is $SW?"

I think most of them knew who $SW was, they just hadn't associated his name with him. I explained who he was, and they nodded in recognition.

They asked, "What does he use this computer for?"

I explained the types of projects he usually worked on. They seemed extremely suspicious of him. The CISO who was with them started to sign into the local admin account.

It dawned on me at that moment that as he logged in to the local admin account everything would become fully XP-ified. I started to shake my head and thought, "This is going to good."

The CISO's eyes bulged as he logged in and he looked at me and asked, "What is this?"

One of the other members of the infrastructure told him, "Oh it looks like someone put a custom skin on the admin account."

I then explained that it was something $SW and I had been doing on the admin account, as a sort of test to see how much like XP we could get it to look.