Re: Running a program with elevated priveleges

From: Valery Pryamikov (valery_at_harper.no)
Date: 04/12/05 

Date: Tue, 12 Apr 2005 18:49:41 +0200

"Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com> wrote in message
news:%23hyXMW3PFHA.3544@TK2MSFTNGP12.phx.gbl...
> "Valery Pryamikov" <valery@harper.no> wrote in message
> news:uXTojt2PFHA.1932@tk2msftngp13.phx.gbl...
> <snip>
>> Well, "simply" might be a bit of non-understanding <g>. Being able to
>> change the password is not the same as being able to read the clear text
>> password. Think of setting COM+ application to use identity of existing
>> user... Do I need to say any more?...
>
> An admin could do something silly like this with an empty COM+ application
> too. An ignorant admin doesn't need developer help to wreak havoc.

And what's your point? Are we talking here about competencies or about the
facts?

I'm just warning that COM+ and DCOM stores password in unencrypted form in
LSA secret. If I remember it correctly COM+/DCOM LSA secrets are named as
APPID:{APPID_GUID_HERE}. You can use any version of lsadump for that, or you
can use my very simple PrintSecret utility that I wrote back in 1997 (you
can find PrintSecret together with its source code on my website - just
following "Relics from DCOM era" link). It is not like "sky is falling"....
more over - it is not any problem at all if alternative credential of COM+
application are used correctly. And that "correct using" first of all means
a separate account that is not used for normal user login (i.e. has "deny
logon interactively" right).

BTW: COM+ applications are used for accessing domain resources much more
often than you probably think ( looking at your arguments in your prev post
makes me think that you think that .... :-) ). Database connections are one
of the most usual examples. And another btw: during Windows DNA time it was
one of the major advises - to use Integrated Windows Authentication on
Database Server on the back-end; in the middle tier - to run COM+ component
with account that has necessary access rights to the databases (and
databases are usually running on separate computers).

-Valery.

http://www.harper.no/valery

Relevant Pages

  • Re: Problems accessing the ASPNETDB.MDF file
    ... Nicole Calinoiu wrote: ... I've never even seen the application pool. ... If you can't use IIS Manager on the server, you can access the account ... "Failed to update database ...
    (microsoft.public.dotnet.security)
  • Re: Running Jboss on Iseries (AS400) connecting to DB2
    ... database workload and WebSphere did compete for one processor and both ... BTW: the as400 standing there was scaled for running webSphere and the ... database and "tuned", both done by big blue itself. ... conclusion java is too slow, or the as400 isn't ready for java and both ...
    (comp.sys.ibm.as400.misc)
  • Designing and Access Questions
    ... BTW all you Gurus on this forum ... I know about the primary key, but for some reason, sometimes my ... How do you setup a database so that others can use it simultaneously? ...
    (microsoft.public.access.tablesdbdesign)
  • Re: Syntax for multiple WHERE in recordset?
    ... > Heres what I have (and this work fine BTW): ... > cnn, adOpenDynamic, adLockReadOnly ... Get the actual SQL string, and try it directly against the database. ...
    (microsoft.public.vb.controls)
  • Re: Compile error causes MDE creation to fail in A97???
    ... I kept a copy of the database with the flawed ... BTW, is /DECOMPILE commandline option one ... of those where I should go RTMFHF as some ...
    (comp.databases.ms-access)