Networks
by saihib
The RunAs utility in WinXP Pro has a /savecred option. Is there a GPO setting to disable this on administrator workstations so passwords must be provided by admins?
This question posed on 12 April 2005
Sadly, there doesn't seem to be one. Many people have lamented the fact that the /savecred option in RunAs can be a massive security hole. With this in mind, I've recommended in the past not using RunAs to run programs in the context of an administrator, simply because it's too easily defeated. There are a number of better solutions, such as TQRunas, which allows you to run programs as administrator without revealing administrator credentials to the end user. CPAU is another (freeware) solution to the same problem, again with some more attention paid to security
Poster rated this answer.
You aren't trying hard enough. That's the easy way out. This obviously doesn't help the problem short of disabling the runas command. There has to be a place this information is stored. We just need to figure out where it is and then come up with way to deal with it.
by gooshie
There is a security policy you can set to disable this. However, it will also disable saving credentials for Passport, network shares and Exchange Server.
Under Security Options, set "Network access: Do not allow storage of credentials or .NET Passports for network authentication" to Enabled. Or, you can change it in the registry by setting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\disabledomaincreds to 1.
Poster rated this answer.
This discussion is closed to new replies.
Sort by Trending