RE: Disabling sharing and group policies

From: Robert Blackwell (robert_at_snrdesigns.com)
Date: 09/14/03

  • Next message: Mark Kovacic: "Why Programs get written to need admin priveleges." 
    To: "Focus-Ms" <focus-ms@securityfocus.com>
Date: Sun, 14 Sep 2003 13:18:02 -0700

            This was off topic from what Matt was originally asking about but I will
    clarify somewhat here. As far is I know at this point in time, a standard
    user on an active directory domain cannot change group policy objects. Once
    the local machine is off of the domain the picture changes dramatically. Get
    local administrator access by using your favorite exploit ( Mount from
    Linux, hash the repair dir...etc ), log on to local machine as administrator
    and make whatever changes to the registry you want. This will not stay if
    you log back onto the domain but it allows you to install programs and
    things of that nature that will hang around after you log back on to the
    domain.

            If a domain user is anything higher than user(has registry write access),
    they will be able to edit the registry with a third party reg app and
    suppress group policy refresh and edit all other registry values for the
    local machine that GPA has put in place. These will stay in effect until the
    machine is rebooted or the network connection is lost.

            I'm not an authority on the group policy admin at the domain level but I
    believe there are settings that can be changed to make all of this at least
    more difficult to accomplish. I was simply trying to point out that group
    policies are not an iron clad security measure. I would tend to consider
    them more of an obfuscation tool but a good tool nonetheless as long as it
    is used correctly.

    ---------------------------------------------------------------------------
    KaVaDo provides the first and only integrated Web application scanner and
    firewall security suite that prevent Web applications attacks, the most
    common form of online exploitation. Download a FREE whitepaper on Security Policy Automation for Web Applications.
    http://www.securityfocus.com/sponsor/KaVaDo_focus-ms_030818
    ---------------------------------------------------------------------------

  • Next message: Mark Kovacic: "Why Programs get written to need admin priveleges."

    Relevant Pages

    • Re: Bit of advice on current AD structure.
      ... If you can do everything you need to do from a GPO and security standpoint there is no reason to move to something more complex. ... So you need to figure out what your security and group policy strategy is, then make your design. ... I am really disliking native delegation of security for user objects more and more as new apps come out and having rights to the users gives you rights to harm the apps, things like Exchange come to mind here where an admin who can directly manipulate user objects can cause nightmares for folks managing the Exchange Service. ...
      (microsoft.public.windows.server.active_directory)
    • Re: restrictions in effect
      ... I wonder if some security software installed on that client PC is causing your inability to change the home page. ... You could control the home page with a group policy, but it seems like that would be applying elsewhere besides this one PC. ... Then for the printing thing, I think I'd start by going to the IE Internet Options, Advanced tab, and click "Restore advanced settings." ...
      (microsoft.public.windows.server.sbs)
    • Re: lets vote for better security
      ... Liberals and security professionals who occassionally wear a black hat. ... Then MSFT started disabling things by default and a lot of the community ... Since when is an app responsible for the ... :>: default installation and be disable-able by Group Policy. ...
      (microsoft.public.security)
    • Re: lockdown desktop without Group Policy
      ... security groups were removed from the list. ... I can now no longer edit group policy. ... Logon as an administrator ... Create a new local group named "GP Editors" ...
      (microsoft.public.windows.terminal_services)
    • Re: Editing GP
      ... Group Policy settings. ... Create a new local group named "GP Editors" ... Security - Advanced ... Within the GroupPolicy folder, ...
      (microsoft.public.windows.terminal_services)