RE: Testing two bank laptops. winxp vpn client

Disable cached credentials via a domain Group Policy Object. The best way
to do this is by creating a container group for the laptop machine accounts
in the domain.

Caveats? The user will have to login via a RAS connection. The other
alternative is two-factor auth, which will allow safe use of cached creds.

"To turn off cached credentials, use a Group Policy Object (GPO) to set the
number of cached credentials to zero. Users can still log on using local
user accounts, but in most environments, it's unusual for users to have
local user accounts on their clients. You might consider changing the cached
credential setting only for desktop computers, as laptop users may have a
legitimate need to log on when they can't contact a DC."
http://www.mcpmag.com/columns/print.asp?EditorialsID=658

More here:
http://www.windowsecurity.com/articles/Implementing-Troubleshooting-Account-
Lockout.html

http://www.windowsdevcenter.com/pub/a/windows/2004/05/18/ug_caching.html

http://www.windowsdevcenter.com/pub/a/windows/2004/05/18/ug_caching.html



-----Original Message-----
From: Bob WIlliams [mailto:sopiaz57@xxxxxxxxx]
Sent: Sunday, February 12, 2006 9:34 AM
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: Testing two bank laptops. winxp vpn client

Hey All,

I have a client who wants two bank laptops tested. I want to do some
reasearch on a fix for a problem I know they are vulnerable too. They
use the WIN xp VPN client which saves the password, giving someone who
steals the laptop an easy way into the corporate network.

Does anyone know how I can disable this feature so employees cant save
the password?

Thanks in advance//

--------------------------------------------------------------------------
----
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers
are
futile against web application hacking. Check your website for
vulnerabilities
to SQL injection, Cross site scripting and other web attacks before
hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
--------------------------------------------------------------------------
-----






------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------

Relevant Pages

  • Re: Testing two bank laptops. winxp vpn client
    ... Cached credentials are not the same thing as a saved password for VPN connections. ... The number of cached creds to save in the LSA do not affect the "Save Password" option for MS VPN clients at all. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
    (Pen-Test)
  • Re: C-Drive stem folders with duplicate website info???
    ... Publisher as a website creation tool. ... We talked briefly about my desktop running Windows Vista Ultra with IE 8, ... and my laptop running Windows XP with IE 7. ...
    (microsoft.public.publisher.webdesign)
  • Re: C-Drive stem folders with duplicate website info???
    ... and my laptop running Windows XP with IE 7. ... there would be fewer problems when I moved my .pub file for my website ... publisher webpage, and how to make it work? ... > I then loaded the index_files into a folder, ...
    (microsoft.public.publisher.webdesign)
  • Re: Problem with ICS
    ... I have set up ICS on my Desktop and Laptop, ... Connects to Internet via wireless router to broadband DSL connection. ... IE just waits forever to connect to a website directly. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Cached Credentials stop working all of a sudden
    ... thanks for your hints. ... We left the number of previous logons to cache at ... using the laptop. ... Cached credentials do not time out, ...
    (microsoft.public.windows.server.active_directory)