Meanwhile, enhanced group policy controls in Vista will allow administrators to exercise much greater control over end-user systems than current Windows technologies permit, Chan said. With the new controls, IT administrators could enforce polices that prevent end users from connecting USB flash drives on their systems -- which are used to download and store data -- without explicit administrator authorization he said.

"It's much superior, by the way, to the old method of caulking" or even super-gluing USB ports to prevent them from being illegally used, Chan said.

The lockdown capability is part of a broader set of User Account Control (UAC) features in Vista aimed at limiting the traditional administrator-level access that Windows users have until now enjoyed. UAC will allow IT administrators to maintain greater control over enterprise Windows systems by limiting users' ability to install software or modify certain system settings.

Support for functions like UAC will finally give Windows some of the same security functions available in operating systems such as Unix for years, said Andrew Jacquith, an analyst with the Yankee Group in Boston. But the company needs to ensure that the functionality doesn't come at the cost of usability and compatibility with previous applications, he said. The same is true of the BitLocker encryption ability, he said.

"It is a very important technology but it is going to be version one," and therefore unlikely to be as ready as some of the more mature products in the market, he said.