-- You can logout. Then login as a user with appropriate rights.
-- Shift-Right-Click & use RunAs to run a program as a user with appropriate rights. I'm particularly fond of running .MSCs (MS Mgt Consoles, like DEVMGMT.MSC) & regedit this way. Even when I'm at the PC, just to avoid logout/login times.
-- XCMD allows you to specify the user/pass to connect to the remote PC as.
Though WMI isn't a remote control program, it does allow you to connect to a remote PC & access/modify many things.
-----Original Message-----
From: ATarasul (at) SpencerStuart (dot) com [email concealed] [mailto:ATarasul (at) SpencerStuart (dot) com [email concealed]]
Sent: Tue 2/18/2003 11:58 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Cc:
Subject: Windows station permissions, remote control programs, lower priviledge accounts
I've found that a big stumbling block to run remote control programs
under
lower priviledge accounts are default security set on window station and
desktop kernel objects.
As they allow by default access by LocalSystem it's impossible to run
remote control
program on lower privilidged account.
I've tested this on Terminal Services, VNC and PCAnywhere.
Is anybody have any idea about how to reconfigure windows to change
permission on window station and
desktop kernel objects? Are any tools exists to do this? Can this change
be persisted?
As for suggestion to microsoft I think there should be additional user
right on policy/user rights - "allow remote control" which will set
-- You can logout. Then login as a user with appropriate rights.
-- Shift-Right-Click & use RunAs to run a program as a user with appropriate rights. I'm particularly fond of running .MSCs (MS Mgt Consoles, like DEVMGMT.MSC) & regedit this way. Even when I'm at the PC, just to avoid logout/login times.
-- XCMD allows you to specify the user/pass to connect to the remote PC as.
Though WMI isn't a remote control program, it does allow you to connect to a remote PC & access/modify many things.
-----Original Message-----
From: ATarasul (at) SpencerStuart (dot) com [email concealed] [mailto:ATarasul (at) SpencerStuart (dot) com [email concealed]]
Sent: Tue 2/18/2003 11:58 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Cc:
Subject: Windows station permissions, remote control programs, lower priviledge accounts
I've found that a big stumbling block to run remote control programs
under
lower priviledge accounts are default security set on window station and
desktop kernel objects.
As they allow by default access by LocalSystem it's impossible to run
remote control
program on lower privilidged account.
I've tested this on Terminal Services, VNC and PCAnywhere.
Is anybody have any idea about how to reconfigure windows to change
permission on window station and
desktop kernel objects? Are any tools exists to do this? Can this change
be persisted?
As for suggestion to microsoft I think there should be additional user
right on policy/user rights - "allow remote control" which will set
those security access automatically.
Thanks
Alexander
[ reply ]