or install only those applications and scripts which have been digitally signed or have a certain trust level, thus preventing the execution of untrusted programs and scripts. Administrators can define a default rule using the Local Security Policy snap-in, and exceptions to that rule. The types of rules include: Hash Rule, Path Rule, Certificate Rule and Zone Rule which identify a file by its hash, path, software publisher's certificate or Internet Explorer-zone respectively. For example, an ActiveX control can be restricted to run only for a particular domain by specifying a certificate rule-based software restriction policy. Other security and privacy features Each logon session receives its own set of drive letters. They cannot be shared. The Security permissions user interface is improved over Windows 2000. A new property sheet called Effective Permissions evaluates implicit permissions against explicit permissions and assigned permissions against inherited permissions. When setting object permissions, the user names, groups and security principals can be searched on the domain by specific criteria. The Secondary logon (Run As) feature allows running programs with a restricted token if the Protect my computer and data from unauthorized program activity option is checked. For non-domain computers, network logons and secondary logons (Run As) are disabled for user accounts with blank passwords. Only logons from the main physical console logon screen will be allowed for blank passwords. If the Security Accounts Manager (SAM) database is deleted from another OS, Windows XP will not allow bypassing the logon and will show an error message and then shut down the computer. Digest SSP for HTTP and LDAP queries between Windows and non-Windows systems where Kerberos is not available. IPsec configuration for server or domain isolation is simplified with the Simple Policy Update which reduces the number of IPsec filters from many hundreds of filters to only two filters. The Everyone user group no longer includes the Anonymous SID. Windows XP introduced the LOCAL SERVICE and NETWORK SERVICE accounts to run certain Windows services in isolation so that the privileges and access assigned to services is reduced to just those needed for their roles. This way, any potential attack surface is reduced when an attacker is exploiting the service. AuthZ API which implements the NT kernel Security Reference Monitor in user mode for applications to protect objects. P3P support in Internet Explorer 6 Networking and communication features Wi-Fi networks Windows 2000 wireless support did not support