Re: disable net create command

From: snnto (sjquat_at_yahoo.com)
Date: 11/11/03 

Date: Tue, 11 Nov 2003 05:33:08 -0800

batch file created is:
net user <user> <password> /add
this creates a local acct. which doesn not get the
restictions from group policy. my mistake it's not admin
acct just unrrestricted through group policy.
thanks, santo (learning in the fly)
>-----Original Message-----
>What was the batch file? You can not "create" an
administrator account via the
>operating system without already having administrator
rights. Now if he can boot from
>a cdrom/floppy or other device he may have used a
password reset program or renamed
>the sam account. --- Steve
>
>
>"santo" <anonymous@discussions.microsoft.com> wrote in
message
>news:041601c3a7f0$eca4aa70$a501280a@phx.gbl...
>> a user created a local admin account by writing a net
>> create batch file in wordpad and ran it creating a local
>> admin account. he logged on this account and then was
able
>> to use net send. i disabled run and other functions from
>> the students but this was a creative way around. any
>> suggestions to prevent users from using the net create
or
>> creating batch files or any other suggestion. i'm using
>> server 2000 and i'm ok with active dir and group policy.
>> clients are using windows 2000. thanks, santo
>
>
>.
>

Relevant Pages

  • Re: Group Policy Editor
    ... don't want to let guests run in an admin account. ... If you mean *some* programs - group policy isn't where you do stuff ... Oh - and don't forget to complain to the product developers about ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Group Policy Editor
    ... software installation node like the help files say there is. ... want to let guests run in an admin account. ... If you mean *some* programs - group policy isn't where you do stuff like ... You're right, it's not all apps, just some apps. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Group Policy in a NON Active Directory environment
    ... You could use a batch file or other script to roll out group policy ... I have a bunch of Win2K Pro machines... ... > prefer to just prevent them from changing the screen saver settings. ...
    (microsoft.public.win2000.security)
  • Re: How to launch program only for certain group>
    ... If you start your program with 'start /w myprogram' it will not end the batch file until the program exits. ... @REM Launch MyProgram except if Administrator ... I then designate this batch file run by using the Group Policy Editor on the TS Server: ...
    (microsoft.public.windows.terminal_services)
  • Re: folder permissions
    ... permissions on the folder will change between restarts (or if you have a ... reliable mechanism that enforces regular restarts). ... I can do this using the group policy or maybe a start up batch file using ...
    (microsoft.public.windows.group_policy)