Re: disclosure the administrative password

d.pigna_at_email.it
Date: 02/02/05

  • Next message: Marc Fossi: "SecurityFocus Microsoft Newsletter #226" 
    Date: Wed, 02 Feb 2005 16:55:12 +0000
To: focus-ms@securityfocus.com

    Hi Boris

    What about something like:

    1) Create a WorkstationAdmin who has admin privileges on workstations
    (local admin), and NOT on servers, active directory, network folders, etc...
    This will ensure, if the password is compromised, that only your
    workstations will be at risk.

    2) If you have several OUs and several Local Administrators/Supervisors,
    create different WorkstationAdmins.
    Again: the lowest number of machines compromised in case someone will
    get this password.

    3) Change this password(s) EVERY DAY. Or every hour.

    A question from my side, now.

    How many times these operations are performed every day???

    Everyday operations have to be easy and fast. In this case, I suggest
    you to give your Supervisors a wide range of "freedom".
    Otherwise you'll get a call everytime a normal maintenance operation is
    performed on a remote, lonely and unuseful machine (something you don't
    want to happen).
    It's better to have 5 workstations compromised every year - that need to
    be reinstalled - than 50 calls every day.

    How many workstations/LocalAdmins do you have???

    Is there a REAL security risk in your environment? Who can be really
    dangerous for you? If you're at risk, and you have to protect sensible
    information, you'll need to give up on usability, and go for the
    security (i.e. change LocalAdmins passwords everyday).
    If you don't have something really important to protect... c'mon, just
    make LocalAdmin life easy.

    If you're managing 10.000 machines in a high school, what data are you
    trying to protect on every single workstation? PPT files for the art
    teacher and some stupid videos downloaded from students?? ;-)
    Let them play, and mess up!

    It could be nice to have a final report on this question...
    Something that will put together all these suggestions and try to line
    out a security model (from very weak to very strong) for different
    security needs.

    Hope this helped.
    Davide

    Boris Skoblo wrote:
    >
    >>> Hi All,
    >>>
    >>> There is a usual situation: on normal users computers ( W2k and
    >>> Winxp ) an administrator should perform an administrative actions
    >>> (for example, with help RunAs) thus the administrative password is
    >>> entered. Do exist a potential possibility that on the user's computer
    >>> there is keylogger.
    >>>
    >>>
    >>> What ways to perform administrative operations exist, thus not
    >>> endangering disclosure the administrative password? There are some
    >>> limitations:
    >>>
    >>> 1. usage of smarts-cards and others hardvare devices are not
    >>> applicable .
    >>>
    >>> 2. performed operations cannot be delegated for various reasons
    >>>
    >>> 3. keylogger is custom designed and any of existing protective
    >>> software yet does not find out it
    >>>
    >>> ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Marc Fossi: "SecurityFocus Microsoft Newsletter #226"

    Relevant Pages

    • RE: block internet at two workstations
      ... It looks like your router only allows ... block internet at two workstations ... prospectus based upon the core principle concepts of security. ...
      (Security-Basics)
    • Re: How to ... 2nd request
      ... There are only 3 ways to restrict what workstations users ... There are two policies you can set to acheive the desired results. ... "Allow logon locally" you could set this up to be inclusive of all groups ... And yet another caveat to policies under the security node. ...
      (microsoft.public.windows.server.general)
    • Re: How to ... 2nd request
      ... There are only 3 ways to restrict what workstations users ... There are two policies you can set to acheive the desired results. ... "Allow logon locally" you could set this up to be inclusive of all groups ... And yet another caveat to policies under the security node. ...
      (microsoft.public.windows.server.active_directory)
    • RE: Remote Installation Services, DoOldStyleDomainJoin=Yes
      ... This security setting determines which groups or users can add workstations ... On one of the Domain Controllers, open Domain Controller Security Policy ... >Microsoft CSS Online Newsgroup Support ...
      (microsoft.public.windows.group_policy)
    • Re: Microsoft Strategic Technology Protection Program
      ... servers and workstations through GPOs. ... that it's impossible for users to inadvertently execute worm scripts. ... and other security patches using startup scripts written in JScript. ...
      (NT-Bugtraq)