RE: Risks posed by Windows XP Scheduled Tasks?

From: Dufresne, Pierre (PIERRE.DUFRESNE@MESS.GOUV.QC.CA)
Date: 08/07/02 

From: "Dufresne, Pierre" <PIERRE.DUFRESNE@MESS.GOUV.QC.CA>
To: "'focus-ms@securityfocus.com'" <focus-ms@securityfocus.com>
Date: Wed, 7 Aug 2002 14:34:42 -0400

Of course, remotely scheduling jobs by users is unacceptable.
But, in our environment, anybody can logon on any workstation. So it is easy
for someone to logon on his neighbor's workstation and schedule some script
or program. I know that NTFS permissions will prevent the scheduled script
to access the user' files and that the same script will run as a
noniteractive process. This should restrict quite a bit what such a script
could do. But I am still nervous because scheduling a task is so easy and
also because I am not really sure of what could be done or not.

-----Original Message-----
From: H C [mailto:keydet89@yahoo.com]
Sent: 7 août, 2002 13:13
To: Dufresne, Pierre
Subject: Re: Risks posed by Windows XP Scheduled Tasks?

Pierre,

The risk associated with this is like any other...when
viewed in isolation, by itself, it seems like an
issue. However, in a reasonably well-thought-out
architecture, would you be allowing someone to log on
remotely to your system?

This issue is easily circumvented by simply not
allowing remote users to schedule jobs.

HTH

--- "Dufresne, Pierre"
<PIERRE.DUFRESNE@MESS.GOUV.QC.CA> wrote:
> Hi,
>
> I just read the following from a book called
> Microsoft Windows XP Inside
> Out:
> "The behavior of the Windows XP Scheduled Tasks
> facility points up a fact
> that you should always keep in mind when working on
> a network or sharing
> your own machine with other user accounts: It's
> possible for someone else to
> start a process that runs invisibly while you're
> logged on to your own
> account. Even though a process started by someone
> else is limited by the
> privileges available to that other user, it's
> possible for such a process to
> monitor your activities."
>
> This follows the fact that an ordinary user can
> schedule a task "At system
> startup" or "At logon". And if the user logging on
> is not the same as the
> one who scheduled the task, the task will still be
> executed.
> As a system admin of a network of 10000+
> workstations, this fact makes
> me very nervous. My first thought was a user logging
> on to another user's
> workstation and scheduling something like a key
> logger.
> I am considering the possibility of restricting
> Scheduled Tasks to
> administrators only (I konw there are some GPOs to
> do just that).
>
> Any comments on the risks posed by Scheduled Tasks?
>
> Thank you for your time
>
> Pierre Dufresne

__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com

Relevant Pages

  • Re: Scheduled tasks dont end
    ... All of the "Scheduled Tasks" are run under the authority ... of Winzip's scheduling. ... prompt whenever a Winzip "job" is to be run. ... the security setting in Winzip's security warning option settings. ...
    (microsoft.public.windowsxp.general)
  • Re: Task schedule problems
    ... told me I needed to log on with a password as any scheduled tasks will not ... I have two hard drives both NTFS, ... > My problem is using the win backup utility and scheduling it for a ... > full backup on Sundays at 2 a.m., all the other days I've scheduled a ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Power Options Properties
    ... AVG Anti-virus and Windows Defender to do scheduled scans late at night. ... PC running and do not go into a standby state. ... Do I need to do my scheduling through "Scheduled Tasks" rather from the ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Schedule task runs only when the creator logs on
    ... Try scheduling the jobs to run under the System account with the AT command. ... Hii Sing Chung wrote: ... All the member have no administrative right over the PCs as that is a security requirement. ... If I create similar scheduled tasks for every member, that is, member 1 logged on, create the 3 scheduled tasks, member 2 logged on, created another 3 scheduled tasks, and so on, I then will create 15 scheduled tasks on both machines. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: AT command not producinigcommand prompt
    ... impression that scheduling it via the AT command will produce just that. ... I get a scheduled job id and can watch the scheduled tasks and task ... therefore preventing me from creating my excel based SQL DB ...
    (microsoft.public.windowsxp.configuration_manage)
Quantcast