Question, when you Shift-Right-Click, and run something as another user,
how does that affect how it is logged?
Jim
-----Original Message-----
From: Lee, Alex (NHQ)-EDS [mailto:Alex.Lee (at) Nextel (dot) com [email concealed]]
Sent: Tuesday, February 18, 2003 6:03 PM
To: ATarasul (at) SpencerStuart (dot) com [email concealed]; focus-ms (at) securityfocus (dot) com [email concealed]
Subject: RE: Windows station permissions, remote control programs, lower
priviledge accounts
Once connected via a remote control program...
-- You can logout. Then login as a user with appropriate rights.
-- Shift-Right-Click & use RunAs to run a program as a user with
appropriate rights. I'm particularly fond of running .MSCs (MS Mgt
Consoles, like DEVMGMT.MSC) & regedit this way. Even when I'm at the
PC, just to avoid logout/login times.
-- XCMD allows you to specify the user/pass to connect to the remote PC
as.
Though WMI isn't a remote control program, it does allow you to connect
to a remote PC & access/modify many things.
-----Original Message-----
From: ATarasul (at) SpencerStuart (dot) com [email concealed]
[mailto:ATarasul (at) SpencerStuart (dot) com [email concealed]]
Sent: Tue 2/18/2003 11:58 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Cc:
Subject: Windows station permissions, remote control programs,
lower priviledge accounts
I've found that a big stumbling block to run remote control
programs
under
lower priviledge accounts are default security set on window
station and
desktop kernel objects.
As they allow by default access by LocalSystem it's impossible
to run
remote control
program on lower privilidged account.
I've tested this on Terminal Services, VNC and PCAnywhere.
Is anybody have any idea about how to reconfigure windows to
change
permission on window station and
desktop kernel objects? Are any tools exists to do this? Can
this change
be persisted?
As for suggestion to microsoft I think there should be
additional user
right on policy/user rights - "allow remote control" which will
set
those security access automatically.
how does that affect how it is logged?
Jim
-----Original Message-----
From: Lee, Alex (NHQ)-EDS [mailto:Alex.Lee (at) Nextel (dot) com [email concealed]]
Sent: Tuesday, February 18, 2003 6:03 PM
To: ATarasul (at) SpencerStuart (dot) com [email concealed]; focus-ms (at) securityfocus (dot) com [email concealed]
Subject: RE: Windows station permissions, remote control programs, lower
priviledge accounts
Once connected via a remote control program...
-- You can logout. Then login as a user with appropriate rights.
-- Shift-Right-Click & use RunAs to run a program as a user with
appropriate rights. I'm particularly fond of running .MSCs (MS Mgt
Consoles, like DEVMGMT.MSC) & regedit this way. Even when I'm at the
PC, just to avoid logout/login times.
-- XCMD allows you to specify the user/pass to connect to the remote PC
as.
Though WMI isn't a remote control program, it does allow you to connect
to a remote PC & access/modify many things.
-----Original Message-----
From: ATarasul (at) SpencerStuart (dot) com [email concealed]
[mailto:ATarasul (at) SpencerStuart (dot) com [email concealed]]
Sent: Tue 2/18/2003 11:58 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Cc:
Subject: Windows station permissions, remote control programs,
lower priviledge accounts
I've found that a big stumbling block to run remote control
programs
under
lower priviledge accounts are default security set on window
station and
desktop kernel objects.
As they allow by default access by LocalSystem it's impossible
to run
remote control
program on lower privilidged account.
I've tested this on Terminal Services, VNC and PCAnywhere.
Is anybody have any idea about how to reconfigure windows to
change
permission on window station and
desktop kernel objects? Are any tools exists to do this? Can
this change
be persisted?
As for suggestion to microsoft I think there should be
additional user
right on policy/user rights - "allow remote control" which will
set
those security access automatically.
Thanks
Alexander
[ reply ]