RE: Password Protected Screen Saver and Administrative Password

From: Tom Milliner (tom.milliner_at_verizon.net)
Date: 02/09/05

  • Next message: Miroslaw Slawek Chorazy: "Re: SAM encripted with syskey" 
    To: "'Greg Kelley'" <gkelley@vestigeltd.com>, <focus-ms@securityfocus.com>
Date: Wed, 9 Feb 2005 14:12:32 -0600

    That would work, but the reality is that the vendor has an enterprise
    version of GoToMyPc running on the server. They already keep track
    of separate passwords for 100's of servers across the country. I am
    probably one of the few customers to implement a screen-saver
    password as a means to control access to a common area server. My
    original question was to find out if I was missing something (how to
    let a trusted co-worker close the password protected screen-saver
    without giving them the administrator password).

    I appreciate the many responses...so far, there does not appear to
    be an easy way to do what I want (I wish Microsoft would add an
    enhancement, though). I don't think I should have to give up the
    domain administrator password just to close a password protected
    screen-saver.

    Tom Milliner, CPA, MCSE
    Director of Network Services
    MetroTex Assc of Realtors
    8201 N. Stemmons Frwy
    Dallas, TX 75247
    www.dfwrealtors.com
    mail to: tomm@dfwrealtors.com
    (214) 540-2741
     

    -----Original Message-----
    From: Greg Kelley [mailto:gkelley@vestigeltd.com]
    Sent: Wednesday, February 09, 2005 12:03 PM
    To: tom.milliner@verizon.net; focus-ms@securityfocus.com
    Subject: RE: Password Protected Screen Saver and Administrative Password

    Why not provide a Domain Admin account to your vendor that they can use.
    Setup security auditing so you know exactly when they come in and when
    they leave and what they do. Make sure they provide you information on
    when they plan to do maintenance so you can compare that with your
    security logs. Make sure they also let you know when they have an
    employee who serviced your account leave so you can change the pwd on
    the account.
    Set the account to change pwd every 30 days, remember atleast 10
    passwords and set account lockout. Don't put a time on the lockout,
    make them notify you it is locked and ask you to unlock it.

    Greg Kelley, EnCE
    Vestige, Ltd
    46 Public Square, Ste 220
    Medina, OH 44256
    (330)721-1205 x5432
    (330)721-1206 Fax
    http://www.vestigeltd.com

    -----Original Message-----
    From: Tom Milliner [mailto:tom.milliner@verizon.net]
    Sent: Tuesday, February 08, 2005 9:11 PM
    To: 'Patton Roub'; focus-ms@securityfocus.com
    Subject: RE: Password Protected Screen Saver and Administrative Password

    The vendor has a lot of customers and routinely uses
    GoToMyPC for support. In an ideal world for the vendor,
    there would be no password protected screen-saver to
    deal with. In other words, they could log on as needed (different time
    zones) to do maintenance. The screen- saver actually is a disruption to
    them, but since the server is in a common area, I use it. I also use it
    so that I can keep track of the vendor's maintenance (if something
    breaks after they log on, then I may want to call them)...they have to
    ask us to unlock the screen-saver.

    When I am not there, a trusted co-worker needs to be
    able to unlock the screen-saver.

    I am not understanding the suggestions to make the
    trusted co-worker a local administrator. Since the
    server is a domain member server, I logon as the
    domain administrator. Then it goes to password
    protected screen-saver after 60 minutes of inactivity.
    I know it needs an administrator's password to unlock
    the screen-saver. I have assumed that meant my domain administrator
    password instead of a local administrator password. I will test this
    tomorrow at work.

     
    Tom Milliner, CPA, MCSE
    2404 Summer Place Dr.
    Irving, TX 75062
    (214) 540-2741
    tom.milliner@verizon.net

    -----Original Message-----
    From: Patton Roub [mailto:proub@state.wy.us]
    Sent: Tuesday, February 08, 2005 6:22 PM
    To: focus-ms@securityfocus.com; tom.milliner@verizon.net
    Subject: Re: Password Protected Screen Saver and Administrative Password

    Is this a Windows 2000 Server or Windows Server 2003? If it is, then
    you should consider terminal services in maintenance mode. It requires
    no additional license purchases (two are free) and your vendor can
    connect without going through a fourth
    party's server equipment (GoToMyPC)(trusted?/untrusted?)
    to get there. They would log in as themselves (event logging
    good) and their access rights can be controlled. In terminal
    services, they also would not see your screen saver as they
    would have their own session/desktop/etc.

    Patton Roub, BSEE, MCSE
    proub@state.wy.us

    >>> "Tom Milliner" <tom.milliner@verizon.net> 2/7/2005 8:07:04 PM >>>
     
     
    Does someone know a way to allow a normal user to
    release a server password protected screen-saver
    without giving the user the administrator password?

    I need this so that third-party support can access
    our server via GoToMyPC when I am not there. The
    password protected screen-saver blocks them from
    remote access to fix problems. I cannot always be
    on-site to assist by supplying the screen-saver
    password.

     
    Tom Milliner, CPA, MCSE
    tom.milliner@verizon.net

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Miroslaw Slawek Chorazy: "Re: SAM encripted with syskey"

    Relevant Pages