Microsoft Windows 2000 Directory Services Restore Mode Blank Password Vulnerability
During the boot process, Windows 2000 Server provides a number of operating system modes to assist an Administrator in troubleshooting and restoring a damaged system configuration. In the event that the "Configure your Server" tool was implemented on a system in order to promote it to domain controller status, a blank password will be assigned to the operating system mode 'Directory Service Restore Mode'. This would allow a malicious user who had physical access to the machine to log on in Directory Service Restore Mode with administrative privileges.
The "Configure your Server" tool is used in order to promote a server to become the first domain controller in a forest, which is set of Active Directory domains. The vulnerability lies within the fact that during implementation of the tool, a null password will be assigned to Directory Service Restore Mode. Any user who could physically access the machine would be able to log onto the machine and perform administrative duties that can be exercised in Directory Service Restore Mode. This would also give the user the capability to install a malicious program which would be executed after reboot.
When the password for Directory Service Restore Mode is modified, it is synchronized with the password of the Recovery Console. Therefore, the Recovery Console is also designated a blank password in this situation.
The DCPROMO tool which accomplishes the same task as the "Configure your Server" tool is not affected by this vulnerability.
Successful exploitation of this vulnerability could lead to a full compromise of the system or the domain.