Software

Ask something
Question Locked

Local Security Policy Issue

0 helpful
4 replies

by jcferrer2

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a set of questions for any one out there who can answer it. My first question is I have a user who is able to change his local permission profile on his pc from a user to administrator and I don't know how he is doing this. By the way we are using Windows 2000 Pro. The second question if he is able to change his permission can he prevent us from accessing his pc )logging in and accessing any important data on it. The second question is.., if he is able to change his permission from user to administrator on his pc is there any way he could change his network profile from a user to administrator as well?

Thanks,

Jose Ferrer
jferrer@sacfirmonline.com

4 replies

by tig2

Was when the user had gotten the Admin pass. he then elevated his permissions for his user account.

Any way to see if this was the route taken? If so, you can bet that he also found a way to change his network profile.

Change the admin pass and re-image his machine. See if he can do it again. Keep the new admin password from anyone without strict need to know. Or set it up as a two week test- write the new admin pass on a piece of paper that is sealed in an envelope in your boss's care.

If the pass was compromised, there may be more to the problem than you know now.

Good luck!

by chris.mcquaid

before changing the administrator's password and everything that entails, it might be worth checking the Event Logs both locally and on the DC (assuming that you have enabled the relevant audits)to see if you can find out what it is this user has done. If you don't log these events, it's probably a good idea to start doing so.

Good Luck!

Also, I have to ask why is he/she doing this? There must be something to be gained from it and I would suggest you speak to someone with sufficient authority within your organisation to question this person.

Having said that, if the password has been compromised then 'TiggerTwo' is quite right - you should change it ASAP.

by ic-it

It isn't too difficult for a knowledgable user to escalate his/her account to an administrator in W2K. However you can put a Group Policy (or Reg edit)in place to prevent this. I would also talk to management to ensure that a policy is in place stating the penalty for unauthorized tampering.

System USER Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

HKCU\Software\Policies\Microsoft\MMC\{5D6179C8-17EC-11D1-9AA9-00C04FD8FE93}!Restrict_Run

This discussion is closed to new replies.