Re: Possible inside security breach

From: Oli Restorick [MVP] (oli_at_mvps.org)
Date: 08/28/04 

Date: Sat, 28 Aug 2004 14:33:07 +0100

Yes I realise that, but for someone who didn't know that any user can, by
default, add 10 workstations to the domain, I doubt IPSec was being used.

Agreed on your last point.

Oli

"Paul Adare - MVP - Microsoft Virtual PC" <padare@newsguy.com> wrote in
message news:MPG.1b9a217ee02d5513989a42@msnews.microsoft.com...
> In article <e$2YfPOjEHA.2436@TK2MSFTNGP09.phx.gbl>, in the
> microsoft.public.win2000.security news group, Oli Restorick [MVP]
> <oli@mvps.org> says...
>
>> In fact, if you have a user account, you wouldn't even need to have your
>> machine joined to the domain to gain access to data. Connection to the
>> network is all that's needed and a VPN connection gave him that.
>>
>
> That's not necessarily true all of the time, for example, if your
> internal network is secured via IPSec using Kerberos or Certificate
> auth.
>
> But the bottom line here is that the lack of knowledge on the part of
> the consultant in the OP is the cause of the events that took place.
>
> --
> Paul Adare
> This posting is provided "AS IS" with no warranties, and confers no
> rights.

Relevant Pages

  • Re: If you hack a server joined to domain, how much info can you get ?
    ... way trust to the internal network where the internal network is the trusted ... user there domain administrator credentials on any domain ... Consider using ipsec in your domain. ... server could have a require ipsec policy ...
    (microsoft.public.security)
  • Re: p Security GPO Setup
    ... Workstations to Their Own OU with Client Respond. ... > Your require/request ipsec policy would need to exempt domain controllers by ... > their static IP address which would include then within a permit filter ...
    (microsoft.public.windows.server.security)
  • Re: Internet restrictions part 2
    ... Ipsec is very powerful, but often not used. ... prevent users from trying to access each others computers. ... Of course the "add workstations to the domain" user right would ... combinations of ports and just using AH. ...
    (microsoft.public.win2000.group_policy)
  • Re: user rights
    ... There are still millions of them used as workstations. ... not designed as robust security operating systems and machines running them ... implement a ipsec "require" policy on them within a forest using ipsec, ... a ipsec "client" policy on those W2K/XP computers to be allowed access. ...
    (microsoft.public.win2000.security)
  • VPN connection problems
    ... I'm trying to setup a vpn connection so I can access my computer ... I have IPsec, pptp, and l2tp passthrough enabled with port 1723 being ... ps ipsec services and remote access services are enabled and started. ...
    (microsoft.public.windowsxp.work_remotely)