Re: How to deny access to domain shares from a workgroup computer

I agree that it is curious at first sight, but I am not sure how else it could be.

Lets start from the premise that a user's password should be unknowable except to them. The user name part is a convenience and can add to the security by being obfuscated, but let's assume that it is fairly obvious.

So the chairman of the company has an obvious username and an unknowable password.

What difference does it make if, when asked for his password, he prefixes the domain name or not? The domain name is not secret. The workgroup or server name is not secret. By adding a prefix he is really saying "this version rather than that version of my account".

If the user's password is knowable, then a whole different set of problems arise. Two factor authentication is the solution to weak passwords.

What you are referring to is the convenience of pass-through authentication. When the logged in credentials are tried first. But this is just a convenience. You still have to have the right credentials. NTLM is a method of ensuring the password is not revealed, and Kerberos is a more sophisticated method of ensuring that even if the credentials could be cracked they would not be valid after the event.

So I think what you are describing is a convenience but not a security measure,

Anthony,
http://www.airdesk.com




"swb" <swb_mct@xxxxxxx> wrote in message news:O3H#3l5DKHA.2832@xxxxxxxxxxxxxxxxxxxxxxx
( I posted a version of the question the Small Business Server newsgroup - no response - I hope that doesn't violate a posting rule )

Can anyone explain why a local account on a workgroup computer has access to domain shares (sbs2008) if the local username and password are synchronized
with a domain username and password ?

The local workgroup account is allowed the same access as specified by NTFS file permissions assigned to the domain account of the same username/password.

I though the ACL on NTFS file shares on a Domain Controller required the users access token to include a domain SID for the user.

This seems to be true on all Microsoft networks . . . I audit banks. They give me a domain admin account for my visit. When I create a matching account username/password on my notebook, I have access to all shares on the Microsoft network, only using the domain account they created for me for terminal service logins.

Is there a Security Option in to disable access to domain shares using a synchronized local account on a workgroup computer.

Bigger Picture: What is all the Kerberos Trust path stuff about, if access to shares only requires a synched username/password from any workgroup ?



.

Relevant Pages

  • Re: how do i get help
    ... Did he set up an account for you on his machine? ... to create a new user account on his machine and make sure it's the same username ... |>Identification", this is where you set up the workgroup, ... | We are both using ntfs file system yet our machines behave differently ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Auto-Login to network resource...
    ... > to simply double-click the icon and have the login occur in the ... > background so the user is not prompted for username and password. ... Is this on a domain or a workgroup? ... have an account on the server and be logging onto the domain. ...
    (microsoft.public.windowsxp.network_web)
  • Re: How to deny access to domain shares from a workgroup computer
    ... computer with the same username and password as a domain account. ... If the account on the domain is a domain admin, ... I also have access to the C$ D$ admin shares with the workgroup account. ... A local user account on a workgroup computer not belonging to a domain can ...
    (microsoft.public.windows.server.security)
  • Re: Changed from Domain to Workgroup. Password stopped working!
    ... At this point there is no existing account for the local machine other than ... out the local machine or Workgroup Administrator account. ... my old username was in the Username field of ...
    (microsoft.public.windowsxp.general)
  • Re: Sharing Drives
    ... There is one thing that can be done create a user account on each workgroup ... machine with the name username and password as the Domain user. ...
    (microsoft.public.windowsxp.security_admin)
Loading