[NT] RunAs Allows Bypassing User GPO in Windows XP/2003

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



RunAs Allows Bypassing User GPO in Windows XP/2003
------------------------------------------------------------------------


SUMMARY

Microsoft Windows allows users to define
<http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/prda_dcm_qnos.asp> GPOs (Group Policy Objects) in a domain environment. GPO is used by many network administrators to restrict the permissions of users.

By using the RunAs functionality of Windows it is possible to bypass user
GPO settings completely.

DETAILS

By using the run as or the runas /noprofile commands it is possible to
bypass user GPO settings completely.

Example:
1. Set up a domain with strict security settings. e.g. Software
restrictions policies, hide local drives, remove "run", disable cmd.exe
and so on.

2. Log on to an XP computer in that domain - make a link to cmd.exe -
select "run as" on that link.
3. Logon with another user in the same domain - with the same restrictions
- you'll see that the GPO's will not be loaded for that user.

Vendor Response:
Microsoft was contacted by the author, and replied that user restrictions
under GPO are not to be used as a security measure, but instead, it is
used to prevent users from damaging their environment.

Note that GPO restrictions are widely used as a security enhancement, and
several Microsoft documents recommend this step in security policies. For
example in:
<http://www.microsoft.com/smallbusiness/support/articles/sec_winxp_pro_server_env.mspx#EJAA> http://www.microsoft.com/smallbusiness/support/articles/sec_winxp_pro_server_env.mspx#EJAA


ADDITIONAL INFORMATION

The information has been provided by <mailto:espen@xxxxxxxxxxxxx> Espen.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • Outsourced passports netting govt. profits, risking national security Part 1 of 3
    ... By Bill Gertz - This is the first in a three-part series on the outsourcing of passports. ... The United States has outsourced the manufacturing of its electronic passports to overseas companies — including one in Thailand that was victimized by Chinese espionage — raising concerns that cost savings are being put ahead of national security, an investigation by The Washington Times has found. ... The Government Printing Office's decision to export the work has proved lucrative, allowing the agency to book more than $100 million in recent profits by charging the State Department more money for blank passports than it actually costs to make them, according to interviews with federal officials and documents obtained by The Times. ... The profits have raised questions both inside the agency and in Congress because the law that created GPO as the federal government's official printer explicitly requires the agency to break even by charging only enough to recover its costs. ...
    (soc.retirement)
  • Outsourced passports netting govt. profits, risking national security Part 1 of 3
    ... By Bill Gertz - This is the first in a three-part series on the outsourcing of passports. ... The United States has outsourced the manufacturing of its electronic passports to overseas companies — including one in Thailand that was victimized by Chinese espionage — raising concerns that cost savings are being put ahead of national security, an investigation by The Washington Times has found. ... The Government Printing Office's decision to export the work has proved lucrative, allowing the agency to book more than $100 million in recent profits by charging the State Department more money for blank passports than it actually costs to make them, according to interviews with federal officials and documents obtained by The Times. ... The profits have raised questions both inside the agency and in Congress because the law that created GPO as the federal government's official printer explicitly requires the agency to break even by charging only enough to recover its costs. ...
    (soc.senior.issues)
  • RE: IE Security Group Policy
    ... username and password to access the Companyweb and the GPO did not apply on ... In the Security filtering of the GPO, please select the user account or ... Step 2: Check the IIS settings on the SBS Server: ...
    (microsoft.public.windows.server.sbs)
  • Re: Group Policy Wont Apply Unless User is a Member of Domain Admin. Why?
    ... under Security Filtering? ... the GPO should contain "authenticated ... gpo will only apply if the test user (uTest) is a member of the Domain ... The test workstation is/are running ...
    (microsoft.public.windows.server.sbs)
  • Re: Problem with NT4 domain trusting W2003 domain
    ... | implemented the settings you suggested in the "default domain controller ... | GPO" and not in the local GPO, and verified with GPMC that they are ... |> suspect there are some settings in security options caused this problem, ...
    (microsoft.public.windows.server.migration)