lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2098E9F95A6DFA4D8FE8B6BE30B62E0811C721@nt_server.infosec.ru>
From: gordey at infosec.ru (Sergey V. Gordeychik)
Subject: W2k users, local admin rights and GPOs

-----Original Message-----
From: James Exim [mailto:security@...m.dyndns.org] 
Sent: Wednesday, October 29, 2003 11:51 AM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] W2k users, local admin rights and GPOs

>It has been pointed out several times recently on the SF mailing lists
that
>a W2k user with local administrator rights can prevent group policy

So, Laura say, that they can. 
When I ask - HOW, she point me to the Windows NT 5.0 beta 2 Group Policy
Guide  (http://web.mit.edu/pismere/zaw/group-policy-white-paper.doc) and
HKLM\Software\Policies\Microsoft\Windows\System\DisableGPO parameter.
After some testing I found that DisableGPO have no effect. "Computer
Configutaion" part of policy still applied OK even DisableGPO=1 (so we
can overwrite it). Tested on W2K3 member server.
I think, that this and old solution that been replaced with "Group
Policy loopback" parameter.  

But I can be wrong.

Administrators _can_ disable some settings by direct modification of
registry, but can't prevent can't prevent group policy application.

I hope... 

>Is there really no workaround other than removing 
>the users from the local Administrators group?

I'ts very-very good idea :-)

Sorry, my English is very bad. 




Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ