Windows

I did some testing with TweakIP, which I found at Winfiles.com. It appears work just like the RK "shutdown.exe" program - which is dependent on user rights. There are three things you can do to limit who can remotely reboot your server:

First, open User Manager and focus it on the machine you need to protect against reboots. From the "Policies" menu, select "User Rights". Now edit the groups listed under the following rights:

1: "Force shutdown from a remote system" (I suggest editing this down toAdmins only).
2: "Shut down the system" (again, admins only would be smart).

One last method of buttoning up your server, set the key

HKEY Local Machine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ShutdownWithoutLogon = 1
also removethe DefaultPassword key from the same tree location in your registry.

Now you can verify by logging on as any non-admin user and running TweakIP. It will fail to restart the system.

Part TWO!

To protect against others changing your registry settings, use REGEDT32 to set permissions on your registry keys. I think you'll find a couple of security whitepapers at MS's site if you look around.

1. Mcaffee Remote Control
2. PcAnyWhere 8.0
3. DoubleVision 2.1 http://www.tridia.com/products/dvnt_slick.html

This question was auto closed due to inactivity