RE: Restricting the change of the local administrator account pas sword.

From: Wolf, Glenn (glenn.wolf_at_we-inc.com)
Date: 05/05/04

  • Next message: Miroslaw Slawek Chorazy: "RE: Restricting the change of the local administrator account pas sword." 
    To: focus-ms@securityfocus.com
Date: Wed, 5 May 2004 10:09:27 -0700

    By the way, a user with no Administrative privileges (but who has physical
    access to the machine) can change the local Administrator password anyway
    through a nifty little Linux-based boot disk:

    http://home.eunet.no/~pnordahl/ntpasswd/

    It boots up, and among other things, allows the user to reset any local user
    password (including Administrator or renamed Administrator).

    Glenn

    -----Original Message-----
    From: marco2 [mailto:marco2@neovalens.com]
    Sent: Wednesday, May 05, 2004 8:04 AM
    To: ddraiggoch@coldyne.com; focus-ms@securityfocus.com
    Subject: RE: Restricting the change of the local administrator account
    password.

    Hi Jason

    A user with Administrative privileges has full control of all local
    users and groups -- and there is nothing you can do. Longhorn *may* help
    as it will introduce the "Protected Administrator" which, when enabled,
    will allow you to have pseudo-administrators, and full administrative
    privileges only for applications you have blessed (by means of signed
    deployment manifest).

    Applications which have not been explicitly authorized will run with a
    restricted token, and that token will be used to prevent a number of
    actions such as writing the Program Files tree, writing to the
    HKEY_LOCAL_MACHINE and so on.

    I do not have the full list (but I'd love to see it!) and hence I don't
    know whether changing passwords locally is in o not.

    Keith Brown published an interesting article on the subject:
    http://msdn.microsoft.com/longhorn/default.aspx?pull=/library/en-us/dnlo
    ng/html/leastprivlh.asp

    The only solution I know of is not to grant administrative privileges in
    the first place.

    For those interested, our company has developed something very similar
    to the Protected Administrator for Windows 2000/XP/2003 which allows you
    run only selected applications under elevated privileges under the
    un-privileged user account (we change the privs of the user on the fly).

    The reason I mention our solution is because next Monday we will release
    a "free for home use" version valid for up to five computers.

    You can already grab it now from www.neovalens.com, the free license
    will follow. Just mention FREE in the organization field.

    Cheers,

            Marco
     

    -----Original Message-----
    From: ddraiggoch@coldyne.com [mailto:ddraiggoch@coldyne.com]
    Sent: Wednesday, May 05, 2004 4:34 PM
    To: focus-ms@securityfocus.com
    Subject: Restricting the change of the local administrator account
    password.

    Hi All,

    Ive come accross quite an interesting problem, currently I have an
    environment split into categories such as application management, OS
    management etc on the Windows 2000 and 2003 platform's. On the
    application side we get requests form application administrators to get
    full administrative rights on the system which is accepted on domain
    accounts.

    However, should this user decide to change the local administrator
    account under windows then there is nothing to restrict them doing so as
    I can see. This in essence causes an issue where the OS team builds the
    system with a renamed admin account, and a specific password. This isnt
    disabled as it is relied on should the domain become unavailable and
    access is still required.

    So my question to you all is as follows, how do I restrict the ability
    to change the local administrator password, even at the level of a
    domain account specified as administrator in the local group. Is there a
    setting in woindows that can be turned on so that without knowing what
    the password is the change cannot be made unless you type in the old
    password, new password , and its confirmation?

    Regards

    Jason.

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Miroslaw Slawek Chorazy: "RE: Restricting the change of the local administrator account pas sword."

    Relevant Pages

    • Re: XP Home --> Pro upgrade
      ... WinXP is designed to install and upgrade the existing operating system while simultaneously preserving your applications and data, and translating as many personalized settings as possible. ... The standard security practice is to rename the account, set a strong password on it, and use it only to create another account for regular use, reserving the Administrator account as a "back door" in case something corrupts your regular account. ... As for other accounts with administrative privileges, routinely using a computer with administrative privileges is not without some risk. ...
      (microsoft.public.windowsxp.general)
    • Re: how to disable reset password in Administrator account
      ... there are about 4 ways to change an account password ... backup set a deny permission on his administrator account for the ... > reset the local administrator password, ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Exchange 2007 on new Win2008x64 Hyper-v wont install...
      ... 'Run As Administrator' is actually just requesting elevated privileges for your current account. ... It's odd - I would have thought that a local administrator should be the LAST account to be used to install something like Exchange!! ... Just open the source media folder, right click on SETUP and choose 'Run As Administrator'. ...
      (microsoft.public.exchange.setup)
    • Re: Must all users be administrators?
      ... The familiar look of the AD objects tree you see in Group Policy Editor is ... This seems modestly confusing to an SBS Administrator because there's very ... those rights happen to be nearly unlimited. ... sit a workstation logged on as the Local Administrator, by default, there ...
      (microsoft.public.windows.server.sbs)
    • Re: security account login failed
      ... local administrator attempting access to a domain-authenticated resource ... All user using their domain user account to connect the network, ... this on a DC event log or a local event log? ...
      (microsoft.public.windows.server.security)