By-pass security settings on a standalone computer

From: lagomorph (lagomorph.1szd1n_at_pcbanter.net)
Date: 07/30/05 

Date: Sat, 30 Jul 2005 07:30:10 +0000

Cheers mate!

Unfortunately I couldn't do it within my shift time. (without removing
access to the other admin account).
I did mention the the boss about being able to do things if there was
physical access, and I think he took it well.
He's asked me to come in next time the IT guy is onsite to 'watch'.

Unfortunately, I'm still up for buying drinks for everyone at the next
function.

Regards,
Lagomorph.

Doug Knox MS-MVP Wrote:
> Any computer security is only as good as physical access to the
> machine.
>
> If your computers support booting from floppy and/or CD, there is a =
> freely available utility that will allow you to change/remove the =
> Administrator password on the computer. Once that's done, you can log
> =
> in on the Administrator account and make any changes you desire. Now,
> =
> changing or removing the Admin password does remove access for the =
> person who would normally use it (since they don't know there is no =
> password, or what it was changed to), but that's a minor point.
>
> There are other utilities such as Bart's PE, that will give you similar
> =
> capabilities, if you know what you're doing.
>
> http://home.eunet.no/~pnordahl/ntpasswd/editor.html
>
> In order to prevent this, you need to remove the ability to boot from
> =
> floppy and/or CD in the BIOS, set a BIOS Setup password and ensure that
> =
> the physical case cannot be opened (see the computer's manual for =
> reseting the BIOS's CMOS settings to default).
>
> If you're successful, you can buy me a couple of beers and a big
> honkin' =
> steak next time you're in the Boston area. :-)
>
> --=20
> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart =
> Display\Security
> Win 95/98/Me/XP Tweaks and Fixes
> http://www.dougknox.com
> --------------------------------
> Per user Group Policy Restrictions for XP Home and XP Pro
> http://www.dougknox.com/xp/utils/xp_securityconsole.htm
> --------------------------------
> Please reply only to the newsgroup so all may benefit.
> Unsolicited e-mail is not answered.
> =20
> "lagomorph" lagomorph.1sxz1r@pcbanter.net wrote in message =
> news:lagomorph.1sxz1r@pcbanter.net...-
> =20
> My boss was in the office while I was slagging the IT guy for doing a
> poor job setting up the network & systems.
> I got pulled up to explain what I thought was wrong with the setup.
> To
> cut a long story short, my boss made a bet with me that I can't break
> into the stand alone computer by the end of my shift (9hrs). If I do
> by-pass the admin security he'll pay for a meal and discuss the
> possibility of working with the IT guy to make sure that everything
> is
> good, if not I've gotta buy drinks for everyone at the next work
> function (all night).
> =20
> Problem: Computer running Windows XP Pro.
> Conditions: Create a new user account (admin) without removing access
> the the current admin account. Must use resources from the office or
> internet.
> =20
> Any suggestions?
> =20
> =20
> --=20
> lagomorph- 

-- 
lagomorph

Relevant Pages

  • Re: writing to registry in vista from guest account
    ... Once again, I bring you back to *Virtualization* on Vista, because based on each user, they will have their own VirtualStore in the registry or in case of something happening with the file-system such as a folder. ... By making your application to work with Standard user rights, no UAC escalation or prompt is required for the solution to execute. ... You also don't need a manifest for the application, if it's made to run with Standard user rights and not Admin user rights. ... Like I said, even with UAC disabled, your user admin account is not an account that has full admin rights on Vista. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Error message trying to download
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... I can not apply any updates on any machine in the domain. ... I also tried to log on as the local admin account - still ... I then logged on locally with a local admin account. ...
    (microsoft.public.windowsmedia)
  • Re: Group Policy Editor
    ... don't want to let guests run in an admin account. ... If you mean *some* programs - group policy isn't where you do stuff ... Oh - and don't forget to complain to the product developers about ...
    (microsoft.public.windowsxp.security_admin)
  • Re: How can I change the admin password of all our XP PCs on the doma
    ... You don't go to each workstation and check if that user changed the local admin password. ... If the box has a problem that means you can't use a domain admin account to logon, it is usually quicker to rebuild than troubleshoot. ... If you want to control the Local Administrators on the workstations, just disable the Local Administrator, and then use another GPO or Script that adds a existing security group in your AD as member of the local Administrators on the workstations. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Access denied
    ... you want to let the boss to access certain ... folders, even the admins cannot access them. ... admin level users can easily gain back the permissions since they ... Encrypting File System overview ...
    (microsoft.public.windows.server.active_directory)