[NT] RunAs Allows Bypassing User GPO in Windows XP/2003
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 28 Dec 2005 12:10:07 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
RunAs Allows Bypassing User GPO in Windows XP/2003
------------------------------------------------------------------------
SUMMARY
Microsoft Windows allows users to define
<http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/prda_dcm_qnos.asp> GPOs (Group Policy Objects) in a domain environment. GPO is used by many network administrators to restrict the permissions of users.
By using the RunAs functionality of Windows it is possible to bypass user
GPO settings completely.
DETAILS
By using the run as or the runas /noprofile commands it is possible to
bypass user GPO settings completely.
Example:
1. Set up a domain with strict security settings. e.g. Software
restrictions policies, hide local drives, remove "run", disable cmd.exe
and so on.
2. Log on to an XP computer in that domain - make a link to cmd.exe -
select "run as" on that link.
3. Logon with another user in the same domain - with the same restrictions
- you'll see that the GPO's will not be loaded for that user.
Vendor Response:
Microsoft was contacted by the author, and replied that user restrictions
under GPO are not to be used as a security measure, but instead, it is
used to prevent users from damaging their environment.
Note that GPO restrictions are widely used as a security enhancement, and
several Microsoft documents recommend this step in security policies. For
example in:
<http://www.microsoft.com/smallbusiness/support/articles/sec_winxp_pro_server_env.mspx#EJAA> http://www.microsoft.com/smallbusiness/support/articles/sec_winxp_pro_server_env.mspx#EJAA
ADDITIONAL INFORMATION
The information has been provided by <mailto:espen@xxxxxxxxxxxxx> Espen.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [UNIX] Solaris PC Netlink Insecure File Handling
- Next by Date: [NEWS] Panda Antivirus ZOO Library Heap Overflow
- Previous by thread: [UNIX] Solaris PC Netlink Insecure File Handling
- Next by thread: [NEWS] Panda Antivirus ZOO Library Heap Overflow
- Index(es):
Relevant Pages
- Outsourced passports netting govt. profits, risking national security Part 1 of 3
... By Bill Gertz - This is the first in a three-part series on the outsourcing of passports.
... The United States has outsourced the manufacturing of its electronic passports to overseas
companies — including one in Thailand that was victimized by Chinese espionage — raising
concerns that cost savings are being put ahead of national security, an investigation by The Washington
Times has found. ... The Government Printing Office's decision to export the work has proved lucrative,
allowing the agency to book more than $100 million in recent profits by charging the State Department
more money for blank passports than it actually costs to make them, according to interviews with federal
officials and documents obtained by The Times. ... The profits have raised questions both inside
the agency and in Congress because the law that created GPO as the federal government's official
printer explicitly requires the agency to break even by charging only enough to recover its costs. ...
(soc.retirement) - Outsourced passports netting govt. profits, risking national security Part 1 of 3
... By Bill Gertz - This is the first in a three-part series on the outsourcing of passports.
... The United States has outsourced the manufacturing of its electronic passports to overseas
companies — including one in Thailand that was victimized by Chinese espionage — raising
concerns that cost savings are being put ahead of national security, an investigation by The Washington
Times has found. ... The Government Printing Office's decision to export the work has proved lucrative,
allowing the agency to book more than $100 million in recent profits by charging the State Department
more money for blank passports than it actually costs to make them, according to interviews with federal
officials and documents obtained by The Times. ... The profits have raised questions both inside
the agency and in Congress because the law that created GPO as the federal government's official
printer explicitly requires the agency to break even by charging only enough to recover its costs. ...
(soc.senior.issues) - RE: IE Security Group Policy
... username and password to access the Companyweb and the GPO did not apply on
... In the Security filtering of the GPO, please select the user account or ...
Step 2: Check the IIS settings on the SBS Server: ... (microsoft.public.windows.server.sbs) - Re: Problem with NT4 domain trusting W2003 domain
... | implemented the settings you suggested in the "default domain controller ...
| GPO" and not in the local GPO, and verified with GPMC that they are ... |> suspect
there are some settings in security options caused this problem, ... (microsoft.public.windows.server.migration) - Re: Group Policy Wont Apply Unless User is a Member of Domain Admin. Why?
... under Security Filtering? ... the GPO should contain "authenticated ...
gpo will only apply if the test user (uTest) is a member of the Domain ... The test
workstation is/are running ... (microsoft.public.windows.server.sbs)
