Re: By-pass security settings on a standalone computer

From: Doug Knox MS-MVP (dknox_at_mvps.org)
Date: 07/29/05 

Date: Fri, 29 Jul 2005 14:31:57 -0400

Any computer security is only as good as physical access to the machine.

If your computers support booting from floppy and/or CD, there is a freely available utility that will allow you to change/remove the Administrator password on the computer. Once that's done, you can log in on the Administrator account and make any changes you desire. Now, changing or removing the Admin password does remove access for the person who would normally use it (since they don't know there is no password, or what it was changed to), but that's a minor point.

There are other utilities such as Bart's PE, that will give you similar capabilities, if you know what you're doing.

http://home.eunet.no/~pnordahl/ntpasswd/editor.html

In order to prevent this, you need to remove the ability to boot from floppy and/or CD in the BIOS, set a BIOS Setup password and ensure that the physical case cannot be opened (see the computer's manual for reseting the BIOS's CMOS settings to default).

If you're successful, you can buy me a couple of beers and a big honkin' steak next time you're in the Boston area. :-) 

-- 
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.
 
"lagomorph" <lagomorph.1sxz1r@pcbanter.net> wrote in message news:lagomorph.1sxz1r@pcbanter.net...
> 
> My boss was in the office while I was slagging the IT guy for doing a
> poor job setting up the network & systems.
> I got pulled up to explain what I thought was wrong with the setup. To
> cut a long story short, my boss made a bet with me that I can't break
> into the stand alone computer by the end of my shift (9hrs). If I do
> by-pass the admin security he'll pay for a meal and discuss the
> possibility of working with the IT guy to make sure that everything is
> good, if not I've gotta buy drinks for everyone at the next work
> function (all night).
> 
> Problem: Computer running Windows XP Pro.
> Conditions: Create a new user account (admin) without removing access
> the the current admin account. Must use resources from the office or
> internet.
> 
> Any suggestions?
> 
> 
> -- 
> lagomorph

Relevant Pages

  • Re: File and email Security
    ... your admin team administers such that they can't get at it. ... your admins will have physical access to the data. ... You must therefore hire system administrators that you trust ... You could also have him use a different mail server which only he has ...
    (Focus-Microsoft)
  • Re: security log + unauthorized lgons?
    ... Dan Shallbetter typed: ... alaram system physical access is not a concern. ... I read a best practice white paper once about renaming the admin ... me against that due to other inter-dependencies the admin account ...
    (microsoft.public.windows.server.sbs)
  • RE: penetration test in a Windows 2000/NT network
    ... Given that you have physical access to the computer, ... By bruteforcing and NOT overwriting the local admin password, ... penetration test in a Windows 2000/NT network ... with which I can crack NTLMv2 hashes. ...
    (Pen-Test)
  • [Full-Disclosure] RE: Disabling Cached Logon Credentials
    ... Even with physical access you want to do what you have ... physical server only to change the admin password and do some hack (i.e. ... >Subject: Disabling Cached Logon Credentials ...
    (Full-Disclosure)
  • RE: penetration test in a Windows 2000/NT network
    ... for you to install something like a hardware key logger on a network ... If someone has physical access to the LAN, I don't see why they couldn't ... > no Admin access) is likewise put to me at the disposal. ... with which I can crack NTLMv2 hashes. ...
    (Pen-Test)