RE: services running in windows domain (winXP clients)

From: Brady McClenon (McClenon_at_albany.edu)
Date: 12/16/04

  • Next message: Jose Costa: "Securty Audit Correlating" 
    To: "'Zack Schiel'" <ZSchiel@blueandco.com>, "'Triantafyllidis Christos'" <ctria@physics.auth.gr>, "'Mark Burnett'" <mb@xato.net>
Date: Thu, 16 Dec 2004 12:07:57 -0500

    Note that disabling the remote registry service will not allow you to
    remotely view the clients Event Logs either.

    -----Original Message-----
    From: Zack Schiel [mailto:ZSchiel@blueandco.com]
    Sent: Thursday, December 16, 2004 08:36
    To: Triantafyllidis Christos; Mark Burnett
    Cc: focus-ms@securityfocus.com; bayoglu@uekae.tubitak.gov.tr
    Subject: RE: services running in windows domain (winXP clients)

    You can enforce registry permissions via Group Policy to provide a bit more
    security if you go with this option. If you don't have a need to remotely
    edit these client machines' registries, you may want to disable the remote
    registry service, as well.

    -Zack-

    -----Original Message-----
    From: Triantafyllidis Christos [mailto:ctria@physics.auth.gr]
    Sent: Wednesday, December 15, 2004 1:16 PM
    To: Mark Burnett
    Cc: focus-ms@securityfocus.com; bayoglu@uekae.tubitak.gov.tr
    Subject: RE: services running in windows domain (winXP clients)

    How safe is that?
    i mean if someone is administrator (local administator) can change the
    registry permissions. i need somehow to disable this ability even to
    local admins. i want services to be allowed to run only if that is
    specified in the DC.

    I liked this answer. i'll try it. (Maybe create a group policy setting
    this registry permissions and have it forced)

    Christos Triantafyllidis

    On Wed, 15 Dec 2004, Mark Burnett wrote:

    > Another thing you can do is set registry permissions on
    HKLM\SYSTEM\CurrentControlSet\Services to not allow anyone (even
    administrators) to create new keys. Obviously, this will also make it
    difficult for an administrator to install new legitimate services, so that
    is something you must balance. Another option is to only allow one specific
    administrator or a small group of admins to create new keys.
    >
    > Mark Burnett
    >
    >
    >
    >
    > On Wed, 15 Dec 2004 11:16:54 +0200, Burak Bayoglu wrote:
    >>  As far as I know, DCs only list the services on itself and allows to
    >>  configure the services policy for these ones. Another alternative is
    >>  that if you know the exact path where the executable of the trojan is
    >>  placed, you can use "File System" to give "everyone - deny" rights to
    >>  the file. You may need to create a dummy file on DC to configure thsi
    >>  setting. Or you can restrict the execution of this program using GP
    >>  again. As a result the service will not be run by the client next time.
    >>  As a better solution, you must use an effective anti-virus software to
    >>  protect against well known trojan and virus programs.
    >>  
    >>  
    >>  Burak BAYOGLU
    >>  TUBITAK UEKAE
    >>  Network Security
    >>  Senior Researcher
    >>  CISA, CISSP
    >>  
    >>  
    >>  -----Original Message-----
    >>  From: Christos Triantafyllidis [mailto:ctria@physics.auth.gr]
    >>  Sent: Thursday, December 09, 2004 11:41 PM
    >>  To: focus-ms@securityfocus.com
    >>  Subject: services running in windows domain (winXP clients)
    >>  
    >>  
    >>  -----BEGIN PGP SIGNED MESSAGE-----
    >>  Hash: SHA1
    >>  
    >>  Is there any way to allow only specific services to run at win
    >>  XP clients through domain group policy?
    >>  
    >>  The services rule in group policy allows configure only on the
    >>  specified services.
    >>  
    >>  What if there is a Trojan (or any other unknown program for the
    >>  server group policy) that adds a service in windows xp? can we
    >>  possible disable all services except the ones we want to run?
    >>  
    >>  Thanks,
    >>  
    >>  Christos Triantafyllidis
    >>  
    >>  - --
    >>  PGP key : http://tassadar.physics.auth.gr/~ctria/pgp_public_key.asc
    >>  MD5sum  : *b426d395137af5d2a42c88840e131a5e  
    >>  pgp_public_key.asc* -----BEGIN PGP SIGNATURE-----
    >>  Version: GnuPG v1.2.6 (GNU/Linux)
    >>  Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
    >>  
    >>  iD8DBQFBuMYsJmvANO7gN+YRAnZZAJ9G8ucOM6jNAXXHrKyP2tx04iky3gCeLe90
    >>  /5QboRtTBNj5WOSr2xPyJHI=
    >>  =0QDX
    >>  -----END PGP SIGNATURE-----
    >>  
    >>  
    >>  ----------------------------------------------------------------
    >>  -----------
    >>  ----------------------------------------------------------------
    >>  -----------
    >>  
    >>  
    >>
     ---------------------------------------------------------------------------
    >>
     ---------------------------------------------------------------------------
    >
    >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Jose Costa: "Securty Audit Correlating"

    Relevant Pages

    • RE: services running in windows domain (winXP clients)
      ... Definitely something to be considered thoroughly before disabling. ... I didn't mean to imply that the service only provided direct registry editing access. ... services running in windows domain (winXP clients) ... Note that disabling the remote registry service will not allow you to ...
      (Focus-Microsoft)
    • Re: Outlook Express update KB911567
      ... I disabled McAfee, re-installed the update, and edited the registry. ... When I open Outlook Express 6: ... that disabling Auto Update will leave your computer unprotected even ... any antivirus program when installing updates to make sure the installation ...
      (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
    • Re: Virtual LAN Problem
      ... > connectivity with the remote LAN and from the remote LAN. ... It collapsed after trying to allow it to have a remote DNS address ... Confirm a decent tunnel by pinging the remote site internal clients. ... > But I had full access to the files shares on the SBS box! ...
      (microsoft.public.windows.server.sbs)
    • Re: Virtual LAN Problem
      ... Gateway device and MANUAL DNS settings to get it to work. ... connectivity with the remote LAN and from the remote LAN. ... Confirm a decent tunnel by pinging the remote site internal clients. ...
      (microsoft.public.windows.server.sbs)
    • Remote registry access between two Win XP Pro computers
      ... I'm trying to do remote registry by two different methods: ... I see that the remote registry service is started and is automatic on both ... two keys are HKLM and HKCU. ... permissions or see if I'm on the access list as admin. ...
      (microsoft.public.windowsxp.network_web)
    • Quantcast