Re: Escalate privileges possible on DC?
From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 05/08/04
- Next message: Steven L Umbach: "Re: Recover from log on locally domain setting"
- Previous message: Steven L Umbach: "Re: vpn"
- In reply to: John Howard: "Escalate privileges possible on DC?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 08 May 2004 01:11:00 GMT
In a forest there are transitive trusts between all the domains. However just because
someone has access to a domain controller in a domain does not mean they can
compromise another domain UNLESS it is the root domain which is where the enterprise
admins group is. What makes the root domain special is that it contains the
enterprise admins group which is in the administrators group of every domain in the
forest. Of course anyone gaining access to a domain controller can compromise the
domain for that domain controller and possibly other domains if the domain they
compromise has users that have administrative powers in other domains.
One strategy if an organization wants to keep a single forest is to use an empty root
domain that only contains the administrator which would also be a member of the
enterprise administrator. That domain's domain controllers would need to then be very
secure physically and only a few key people would know the password keeping it secure
in a safe. --- Steve
http://www.winnetmag.com/Article/ArticleID/23521/23521.html --- empty root domain.
"John Howard" <anonymous@discussions.microsoft.com> wrote in message
news:9D63EDEA-3CD7-4907-A48E-FA288205DEB8@microsoft.com...
> We currently have about 200 domains in a single forest. This spans about 100
countries.
> One of our concerns with this design is that an administrator in one domain can
gain access to other domains (gaining enterprise admin rights). As far as I
understand it, local system, local administrators, and any domain account with server
operator privileges can do this if they have access to a DC.
>
> First off, is it true that this attack is possible?
> Secondly, what are you experiences with other setups (multiple forests, a single,
large domain etc.)?
>
> TIA,
>
> - JH
- Next message: Steven L Umbach: "Re: Recover from log on locally domain setting"
- Previous message: Steven L Umbach: "Re: vpn"
- In reply to: John Howard: "Escalate privileges possible on DC?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
