RE: services running in windows domain (winXP clients)

From: Zack Schiel (ZSchiel_at_blueandco.com)
Date: 12/16/04

  • Next message: Scott Mulcahy: "Subdomain security"
    Date: Thu, 16 Dec 2004 12:11:17 -0500
    To: "Brady McClenon" <McClenon@albany.edu>, "Triantafyllidis Christos" <ctria@physics.auth.gr>, "Mark Burnett" <mb@xato.net>
    
    

    Among many other things, like running MBSA scans remotely. Definitely something to be considered thoroughly before disabling. I didn't mean to imply that the service only provided direct registry editing access.

    -Z-

    -----Original Message-----
    From: Brady McClenon [mailto:McClenon@albany.edu]
    Sent: Thursday, December 16, 2004 12:08 PM
    To: Zack Schiel; 'Triantafyllidis Christos'; 'Mark Burnett'
    Cc: focus-ms@securityfocus.com; bayoglu@uekae.tubitak.gov.tr
    Subject: RE: services running in windows domain (winXP clients)

    Note that disabling the remote registry service will not allow you to
    remotely view the clients Event Logs either.

    -----Original Message-----
    From: Zack Schiel [mailto:ZSchiel@blueandco.com]
    Sent: Thursday, December 16, 2004 08:36
    To: Triantafyllidis Christos; Mark Burnett
    Cc: focus-ms@securityfocus.com; bayoglu@uekae.tubitak.gov.tr
    Subject: RE: services running in windows domain (winXP clients)

    You can enforce registry permissions via Group Policy to provide a bit more
    security if you go with this option. If you don't have a need to remotely
    edit these client machines' registries, you may want to disable the remote
    registry service, as well.

    -Zack-

    -----Original Message-----
    From: Triantafyllidis Christos [mailto:ctria@physics.auth.gr]
    Sent: Wednesday, December 15, 2004 1:16 PM
    To: Mark Burnett
    Cc: focus-ms@securityfocus.com; bayoglu@uekae.tubitak.gov.tr
    Subject: RE: services running in windows domain (winXP clients)

    How safe is that?
    i mean if someone is administrator (local administator) can change the
    registry permissions. i need somehow to disable this ability even to
    local admins. i want services to be allowed to run only if that is
    specified in the DC.

    I liked this answer. i'll try it. (Maybe create a group policy setting
    this registry permissions and have it forced)

    Christos Triantafyllidis

    On Wed, 15 Dec 2004, Mark Burnett wrote:

    > Another thing you can do is set registry permissions on
    HKLM\SYSTEM\CurrentControlSet\Services to not allow anyone (even
    administrators) to create new keys. Obviously, this will also make it
    difficult for an administrator to install new legitimate services, so that
    is something you must balance. Another option is to only allow one specific
    administrator or a small group of admins to create new keys.
    >
    > Mark Burnett
    >
    >
    >
    >
    > On Wed, 15 Dec 2004 11:16:54 +0200, Burak Bayoglu wrote:
    >>  As far as I know, DCs only list the services on itself and allows to
    >>  configure the services policy for these ones. Another alternative is
    >>  that if you know the exact path where the executable of the trojan is
    >>  placed, you can use "File System" to give "everyone - deny" rights to
    >>  the file. You may need to create a dummy file on DC to configure thsi
    >>  setting. Or you can restrict the execution of this program using GP
    >>  again. As a result the service will not be run by the client next time.
    >>  As a better solution, you must use an effective anti-virus software to
    >>  protect against well known trojan and virus programs.
    >>  
    >>  
    >>  Burak BAYOGLU
    >>  TUBITAK UEKAE
    >>  Network Security
    >>  Senior Researcher
    >>  CISA, CISSP
    >>  
    >>  
    >>  -----Original Message-----
    >>  From: Christos Triantafyllidis [mailto:ctria@physics.auth.gr]
    >>  Sent: Thursday, December 09, 2004 11:41 PM
    >>  To: focus-ms@securityfocus.com
    >>  Subject: services running in windows domain (winXP clients)
    >>  
    >>  
    >>  -----BEGIN PGP SIGNED MESSAGE-----
    >>  Hash: SHA1
    >>  
    >>  Is there any way to allow only specific services to run at win
    >>  XP clients through domain group policy?
    >>  
    >>  The services rule in group policy allows configure only on the
    >>  specified services.
    >>  
    >>  What if there is a Trojan (or any other unknown program for the
    >>  server group policy) that adds a service in windows xp? can we
    >>  possible disable all services except the ones we want to run?
    >>  
    >>  Thanks,
    >>  
    >>  Christos Triantafyllidis
    >>  
    >>  - --
    >>  PGP key : http://tassadar.physics.auth.gr/~ctria/pgp_public_key.asc
    >>  MD5sum  : *b426d395137af5d2a42c88840e131a5e  
    >>  pgp_public_key.asc* -----BEGIN PGP SIGNATURE-----
    >>  Version: GnuPG v1.2.6 (GNU/Linux)
    >>  Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
    >>  
    >>  iD8DBQFBuMYsJmvANO7gN+YRAnZZAJ9G8ucOM6jNAXXHrKyP2tx04iky3gCeLe90
    >>  /5QboRtTBNj5WOSr2xPyJHI=
    >>  =0QDX
    >>  -----END PGP SIGNATURE-----
    >>  
    >>  
    >>  ----------------------------------------------------------------
    >>  -----------
    >>  ----------------------------------------------------------------
    >>  -----------
    >>  
    >>  
    >>
     ---------------------------------------------------------------------------
    >>
     ---------------------------------------------------------------------------
    >
    >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------


  • Next message: Scott Mulcahy: "Subdomain security"

    Relevant Pages