Re: cracking local admin account
From: Patrick J. LoPresti (patl_at_users.sourceforge.net)
Date: 11/14/04
- Next message: bernardl: "How do I add a security disclaimer in Win2k3 server?"
- Previous message: Digicruz: "RE: Content Advisor"
- In reply to: spence: "cracking local admin account"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 14 Nov 2004 10:48:54 -0500
Sorry I am late to this discussion.
As others have mentioned, if he can boot from media of his choosing,
he can reset the local admin password and do many other things. To
defend against this, configure the boot order in the BIOS, set a BIOS
password, and put a padlock on the case (to prevent manual BIOS
reset).
But a better idea might be to ask yourself why you care if he has
local admin rights to the machine? Unless your network is horribly
misconfigured, in which case you have bigger problems, his admin
access is "local" and thus cannot bother anybody else.
If you are worried about supporting such systems, then don't. In my
I.T. group, we make a simple deal with each user: They can have
non-admin access and let us support the machine; or they can have
local admin access and support it themselves. In the latter case, our
assistance is limited to wiping the machine and rebuilding it from
scratch, which amounts to two minutes of our time. This works for us
and keeps the "power users" happy.
The best I.T. people know that enforcing policy is always secondary to
providing good service.
- Pat
spence <spence@discussions.microsoft.com> writes:
> I have an employee who apparently has a way of cracking local administrative
> passwords. I just learned of this and he has thus far been using this trick
> "for good" (e.g. to by-pass corporate buracracies that impede productivity.)
> Regardless, I've asked him to cease this practice. However, I'd like to know
> if there's a way to make sure he's no longer able. The problem is that I
> don't know how he's done it except that I was told by a coworker that a
> floppy disk of some sort was invovled. I realize that's scant information to
> go on, but I was hoping that someone might be able to offer some guidance on
> shoring up the security on my PCs.
>
> thanks,
> spence
- Next message: bernardl: "How do I add a security disclaimer in Win2k3 server?"
- Previous message: Digicruz: "RE: Content Advisor"
- In reply to: spence: "cracking local admin account"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
