|
|
||
|
Address: Website: Email: |
Malmgren,
Kandestobergade 10 www.TryWare.dk Sales@TryWare.dk |
Press Release |
|
January 2003 |
||
|
|
||
|
|
||
|
Internal security-hole in Windows 2000/XP Local
administrator – Total power of documents on Your colleagues
hard disk
|
How
to find
out if Your Company has got the security hole
How to
solve the
problem, if You are IT-Administrator
|
Does Your Company have the security hole ? |
|
Did You
know, that You - probably - from Your own computer
can open Your colleagues computer with Explorer, and that Your
colleague can’t see, that it’s happening? And that
You - if it works - gains total power of any
documents/files on Your colleagues hard disc ? If You should (and can) install programs on
Your own computer, when You are logged on Your Company’s network, then
Your Company has opened for this internal security-hole in Windows
2000/XP,
if it’s done with GlobalDomainGroups as member of the
LocalAdministratorsGroup. If it does,
the security-hole can be more or less expanded on Your network. It
depends of how Your IT-Administrator installed Windows 2000/XP on Your,
and on the other computers in Your company. There is no
hot fix from Microsoft to solve this internal security-hole. And it
will not come in the future. The cause is, that this isn’t a failure in
Windows 2000/XP, but an un-lucky behavior of the use of the Local Admin
Group on the hard disc. If Your
IT-Administrator knows this internal security-hole, he/she could until
now, only choose to give You the right to install programs, or remove
this right from You. |
|
How to find out if Your Company has got the security hole |
|
Either download W2kTotalPowerWhere.exe from Our
Website www.TryWare.Dk
Or try Yourself right now: 1.
Left-click Start / Run … 2.
Input \\ComputerName\C$ and press ENTER As ComputerName You should input the
ComputerName of one of Your colleagues computer. Dependent of how Your IT-Administrator did
install Windows 2000/XP, You will now automatically get an open Explorer
to Your colleagues hard disc. But please don’t do any disaster. Contact
Your IT-Administrator to fix the problem. Otherwise Your colleagues can
also access Your hard disc. You don’t have to disturb Your colleague to
find out the computer names in Your company. Just do the following on
Your own pc: 1.
Left-click Start / Run
… 2.
Input CMD and press ENTER 3.
Input NET VIEW 4.
Press ENTER If there’s a lot of computers on Your network,
the will roll away in the black window. If so, You can find the
computer names this way: 1.
Left-click Start / Settings
/ Control Panel 2.
Left-click Administrative Tools 3.
Left-click Computer Management 4.
Left-click on the menu Action,
and choose Connect to another computer … 5.
In Look in: Choose the
DomainName You use, when You login to your own computer (after
CTRL-ALT-DEL). 6.
When You have choosed the DomainName, You can
see all the ComputerNames. Important: This is not a hacker’s manual to get
un-authorized access to Your and Your colleague’s computer. It’s simply
a part of how Microsoft has designed the Windows 2000/XP operating
system. More information at: |
|
|
|
TryWareDk has a program assuring You,
that Your users automatically are made a member of the Local Admin
Group on their own computer, with out gaining admin power on their
colleague’s computers. The program gives You many different
possibilities to control, who automatically is made a member of the
Local Admin Group, and who automatically is removed from the Local
Admin Group. There are a number of reports about how the program
secured Your installation. When You input Your ConfigurationRules in the
program, it only takes 1 simple line in all users loginscript to
secure, that Your ConfigurationRules is carried out in the Local Admin
Group on all computers, where the loginscript runs. You can try the program free on 9 computers in
90 days. After the 90 days, the program is very cheap to buy: For more details visit our
Website: www.TryWare.dk |
|
|
|
More
and more programs are upgrading themselves while Your users are logged
in, just think about the internet. You have maybe therefore decided,
that Your users must be able to install programs on their Windows
2000/XP client-computer running on Your network, like they used to be
able to do with Windows 95/98. Installing
programs on a Windows 2000/XP client computer is another matter.
Because there are many different restrictions in the operation system,
because of the Local Groups on the hard disk. The
important group is the LocalAdministratorsGroup. Members of this group
can install programs, because the operating system automatically grants
this group rights to save files in the C:\WINNT\SYSTEM32-folder and to
change important parts of the registry. Any of these
solutions makes the security hole work!
If
You have many client computers it is a hard work for You if You want to
stop the security hole. The only way until now,
is to remove everybody but the LocalAdministrator and
GlobalDomainAdminsGroup, and only add the one and only DomainUser who
uses the computer.
This solution also makes the security hole work! BUT
while the DomainUser is a member of this GlobalDomainGroup, he/she can
make a new local user on every computer on the network, and grant this
local user membership of the Local Admin Group on every computer. And
the DomainUser can do it from his/hers own computer without anyone
seeing anything about it. So
- if You have such a DomainUser, he/she will retain the total admin
power every computer on Your network, even after You have removed the
DomainUser from one of the above mentioned GlobalDomainGroups Another
problem is releasing the password for the LocalAdministrator. You have
probably set the same password for the LocalAdministrator to the same
on all Your computers. Otherwise You can’t support/rescue these
computers, if You don’t know the password. But
releasing the password to an DomainUser, when Your user must install
programs, or having a DomainUser guessing/hacking the password, he/she
will gain TOTAL control over all of the other Windows 2000/XP
computers, from his/hers own computer, even if no other that the
LocalAdministrator is a member of the LocalAdministratorsGroup! Because
of this security-hole, all Your LocalAdministrator’s passwords should
be different. This shouldn't give You any problems, if You remember to
add the GlobalDomainAdminsGroup as a member of the
LocalAdministratorsGroup on each computer. So
there is a lot of work running from computer to computer if You want to
stop this security hole. If
You want to do all this from Your own Windows 2000/XP computer, You
should consider trying Our program free on 9 computers for 90 days. Especially because it’s not
only with Explorer, that You can open the
colleagues hard disc, but being a member of the
LocalAdministratorsGroup on all the computers, You can also: 1.
Left-click Start / Run … 2.
Input REGEDIT and press ENTER 3.
Choose the menu Registry / Connect
Network Registry … 4.
Input one of Your colleagues ComputerName, or
choose Browse … / My Network Places / Entire Network /
Microsoft Windows Network / DomainName / ComputerName Please don’t
manipulate Your colleagues Computers Device Manager: 1.
Left-click Start / Settings
/ Control Panel 2.
Left-click Administrative Tools 3.
Left-click Computer Management 4.
Left-click on the menu Action,
and choose Connect to another computer … 5.
In Look in: Choose the
DomainName You use, when You login to your own computer (after
CTRL-ALT-DEL). 6.
In Name: Input Your
colleague’s ComputerName and press ENTER 7.
Choose System Tools / Device Manager Please don’t
add or remove LocalUsers on Your colleagues Computer: 1.
Start Computer Management
on Your colleague’s computer as described above. 2.
Choose System Tools / Local Users and
Groups Please don’t
manipulate Your colleagues Computers hard disc: 1.
Start Computer Management
on Your colleague’s computer as described above. 2.
Choose Storage / Disk Management Please
don’t
start or stop services on Your colleagues Computer:
1.
Start Computer Management
on Your colleague’s computer as described above. 2.
Choose
Services and Applications / Services Important: This is not a hacker’s manual to get
un-authorized access to Your and Your colleague’s computer. It’s simply
a part of how Microsoft has designed the Windows 2000/XP operating
system. More information at: |
:o) Your brain is like a parachute. It works
best when
it's open
w2k
local admin group windows 2000 permissions
local
admin group W2k: Your colleague's got total
power of Your pc from his own computer on Your corporate Network: Read
TryWareDk's Website - Microsoft Windows 2000 HTML Securityhole Member
Local
Administrators Group Hotfix Admin Admins Administrator Groups Members
Security
Office program programs software freeware shareware Outlook
Distributionsliste
Email Adressbook Adressebog Mandatberegning