RE: local admin vs group policy and apps...

From: Murad Talukdar (talukdar_m_at_subway.com)
Date: 01/18/05

  • Next message: Jim Harrison (ISA): "RE: IIS6 on W2k3 DCs" 
    Date: Tue, 18 Jan 2005 09:42:28 +1000
To: 'Don Gray' <don_gray@busdk12.com>, focus-ms@securityfocus.com

    Yeah--I'm running file/regmon to see what is being changed/written to and
    what every user needs access to--whether to modify or read etc.
    I suppose the next few weeks will be some testing and reading of logs.

    It also appears that as one of the apps is two programs 'married' together
    this seems to make things a little difficult. One of them is a Progress
    database that opens up cmd.exe for long periods of time--I need a clearer
    picture of what it's doing when this happens.

    Thanks to all for the suggestions though--gives me a much clearer picture of
    where to look.

    Murad

    -----Original Message-----
    From: Don Gray [mailto:don_gray@busdk12.com]
    Sent: Sunday, January 16, 2005 11:13 AM
    To: focus-ms@securityfocus.com
    Subject: RE: local admin vs group policy and apps...

    Have you figured why these programs need admin rights? I have circumvented
    many apps by adjusting security on:

    Thier program directory ie c:\legapp (users - modify)
    their .ini ie %systemroot%\legapp.ini (users - modify)
    all users application data allusers\application data\legapp (users - modify)
    %systemroot%\legapp (users - modify)

    I have even had to give (users - modify) rights on %systemroot% (this folder
    only) for a paticular app to run correctly, although I feel it makes a nice
    hole for spyware and viri (theese systems are reimaged every summer)

    About the only app I have that I have to give admin rights on is on that has
    to register dll's via an updater utility.

    -----Original Message-----
    From: Stegman, William [mailto:Bill.Stegman@transcore.com]
    Sent: Fri 1/14/2005 12:01 PM
    To: Murad Talukdar
    Cc: focus-ms@securityfocus.com
    Subject: RE: local admin vs group policy and apps...
     
    If you're using Active Directory, gpo's at the ou level could not be
    rescinded by a local admin account. If a normal user logs in with their
    domain account, all the site/domain/ou gpo's relevant to that computer and
    user would apply. The gpo setting, prohibit access to the control panel,
    is
    only available under the user configuration, and reads that disabling it
    prohibits users from starting the control panel. I've tested this and when
    you try a runas with the local admin account, the control panel does not
    open.

    -----Original Message-----
    From: Murad Talukdar [mailto:talukdar_m@subway.com]
    Sent: Thursday, January 13, 2005 10:11 PM
    To: focus-ms@securityfocus.com
    Subject: local admin vs group policy and apps...

    Hi,
    We have two apps (even calling them legacy seems to attribute some
    undeserved elegance to them) which must run at admin level to function
    properly. I am trying to find out whether the fact that users are allowed to
    be local admins, or even given the runas power to run the app can still be
    locked out of control panel etc through GPOs.

    I mean, if I let people runas then they know the admin password so can
    rescind any GP settings, can't they? How can I shut that possibility out?

    Yes I have asked for the possibility of then apps being recoded to function
    under power users but the development team are of the starving waif variety
    due to under resourcing...this consideration is not high on the list.

    Kind Regards
    Murad Talukdar

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Jim Harrison (ISA): "RE: IIS6 on W2k3 DCs"

    Relevant Pages

    • RE: local admin vs group policy and apps...
      ... Thier program directory ie c:\legapp (users - modify) ... About the only app I have that I have to give admin rights on is on that has ... local admin vs group policy and apps... ... We have two apps (even calling them legacy seems to attribute some ...
      (Focus-Microsoft)
    • RE: How to block users from installing other apps
      ... How to block users from installing other apps ... and add their domain account to the local admin group. ...
      (Focus-Microsoft)
    • Re: Risks of Local Admin Access on Domain PC?
      ... but I won't support apps that won't play by the rules :-) ... > Quickbooks versions earlier than 99 - need local admin ... > Tax software programs - think they need local admin ... Log in as Administrator, ...
      (microsoft.public.security)
    • RE: How to block users from installing other apps
      ... I would find out why they need local admin rights, setup up security audits ... and lock down the box and run through the apps till you get a complete map ... How about a locked down / minimal Terminal Server with Local Admin ...
      (Focus-Microsoft)
    • Re: local admin vs group policy and apps...
      ... Administrators without explicitly granting the end user the same privileges. ... local admin vs group policy and apps... ... > We have two apps (even calling them legacy seems to attribute some ... or even given the runas power to run the app can still be ...
      (Focus-Microsoft)