RESPONSE: Users "bypassing" Group Policy restrictions

From: Gerson Ricardo (gricardo_at_gableseng.com)
Date: 01/27/05

  • Next message: Jim Harrison (ISA): "RE: ISA server logs" 
    Date: Thu, 27 Jan 2005 17:00:26 -0500
To: "Edward VanDewars" <gt4200b@yahoo.com>, <focus-ms@securityfocus.com>, "Zamora, Robert" <Zamora@gableseng.com>

    Edward,

    Talk about circumventing! You indeed have creative users in your midst, to
    say the least. The answer lies with setting local policies to match your
    domain level AD GPOs - and if any user has local admin privileges for
    whatever reason, simply exclusively allow domain access to the
    %systemroot%\system32\GroupPolicy directory, followed by an exclusive 'deny'
    disallowing and local user account, including local administrators, access
    to modify local computer policy.

    Problem should be solved - all without the use of super glue :)

    Cordially,

    gerson j. ricardo
    Gables Engineering, Inc

    -----Original Message-----
    From: Edward VanDewars [mailto:gt4200b@yahoo.com]
    Sent: Thursday, January 27, 2005 8:29 AM
    To: focus-ms@securityfocus.com
    Subject: Users "bypassing" Group Policy restrictions

    We utilize Group Policies and Software Restriction Policies as the primary
    means of limiting unwanted user actions on our desktop machines.

    Recently, however, several of our more "creative"
    users have discovered that if they remove the ethernet cable from the
    computer immediately after logging in (i.e. as soon as their credentials are
    accepted) GPs are not downloaded/applied. These users then are able to use
    "net use" commands to map their necessary network drives so they can work
    with full access to resources usually mapped by GPs but without any of the
    restrictions/limitations we impose and without Software Restriction Policies
    preventing unwanted programs from running (i.e. my nightmare).

    Short of gluing in the ethernet cables, how can I prevent this bypassing of
    GPs? It appears that this is only an issue if a cached local profile does
    not exist on the computer. However, these computers use drive "freezing"
    software to make changes to local disks non-persistent. Thus, at each
    reboot a local cache of their profile is gone. I tried shortening the
    "Group Policy refresh interval for users" but obviously if they don't
    download the policy in the first place the computer will not see the
    shortened refresh interval.

    Any advice is greatly appreciated; thanks in advance.

                    
    __________________________________
    Do you Yahoo!?
    All your favorites on one personal page - Try My Yahoo!
    http://my.yahoo.com

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Jim Harrison (ISA): "RE: ISA server logs"

    Relevant Pages

    • Re: Boy, did I screw up some Group Policies!
      ... Create a new Group Policy for each set of policies you want to enforce. ... (There follows a number of specific policies set under Administrative Templates in the Group Editor.) ... I did all this work from the Domain Controller console, logged in under the Domain Administrator account. ... Now I'm a security novice, so it made no sense to me that after I made these changes, when I logged into a workstation as the Domain Controller, I had no Task bar context menu and no Control Panel. ...
      (microsoft.public.win2000.group_policy)
    • Re: password to expire in 2 days ... will laptop be inexcessable?
      ... This will reveal my general ignorance concerning Group Policy, ... Pro stand-alone (i.e. workgroup) box, the "password age" policy is not ... In Group Policies, none of the various settings is enabled. ...
      (microsoft.public.windowsxp.general)
    • RE: Error adjusting Group Policies
      ... But you should never change those policies. ... It will reset the ... How To Reset User Rights in the Default Domain Group Policy in Windows ... PLEASE NOTE the newsgroup SECURE CODE and PASSWORD were ...
      (microsoft.public.windows.server.sbs)
    • Re: Windows cannot query for the list of Group Policy Objects Event log ID 1030
      ... One of the most common group policy problems which produces hidden policies ... or inconsistent results is when SYSVOL may not be replicating correctly. ... The utility will report all "Policies OK" if all Domain Controllers SYSVOLS ...
      (microsoft.public.windows.group_policy)
    • Re: Policies partially apply
      ... Group Policy problems are often caused by dns misconfiguration ... > clients which apply the computer policies from an AD Windows 2000 Server ...
      (microsoft.public.windows.group_policy)