RE: RunAs

• Previous message: dwr3ck_at_yahoo.com: "Windows Server 2K Lockdown Baseline"
• Maybe in reply to: martin: "RunAs"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Wed, 15 Jun 2005 16:27:46 +0200
To: "k levinson" <levinson_k@yahoo.com>, <focus-ms@securityfocus.com>

Hi,

Be careful about opening up too much file and registry ACLs, at least
when it comes to write permissions. Any default ACL you'll open up will
also be accessible to any other process, and you don't want programs
like Outlook and Internet Explorer having, for example write access to
Program Files, HKLM, SystemRoot and so on.

An alternative, free for local policies, is DesktopStandard PolicyMaker
Application Security which allows you to set per process rules
(privileges, groups membership, etc.).

HTH,

Marco

-----Original Message-----
From: k levinson [mailto:levinson_k@yahoo.com]
Sent: Tuesday, June 14, 2005 5:53 PM
To: focus-ms@securityfocus.com
Cc: gremagehan@web.de
Subject: RE: RunAs

> -----Original Message-----
> From: gremagehan@web.de [mailto:gremagehan@web.de]

> and use this scanner. But only an user with an
admin-rights
> can use this
> scanner.

Usually this is just because of a few missing file or registry
permissions and can be fixed without the need to grant Admin privileges.
Filemon and Regmon from www.sysinternals.com or other utilities can help
you determine what needs to change.

> I thought that I can create a kind of "weakAdmin"
which can
> only use this
> scanner (and can't install some software, remove
users .... )
> Every user can
> then use scanner (as "weakAdmin") and the
(power-)full Admin
> will be reserved
> only for me. Or do you think it can be solved with
an usergroup?

The latter. You cannot reliably create a weak Admin
account and give the user the password. My previous
suggestion about the RunAs icon, while not 100%
secure, is still a possibility.

HTH

kind regards,

Karl Levinson, CISSP

        
                
__________________________________
Do you Yahoo!?
Yahoo! Mail - You care about security. So do we.
http://promotions.yahoo.com/new_mail

------------------------------------------------------------------------

---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------

• Previous message: dwr3ck_at_yahoo.com: "Windows Server 2K Lockdown Baseline"
• Maybe in reply to: martin: "RunAs"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]