Windows Forum

Ask something
Discussion Locked

NT Administration

0 helpful
12 replies

by javaid7

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have recently joined a company that has NT4 environment with Windows 2000 Professional, a very difficult environment to work with. The nature of business is unique and required many persons (almost 7) to have Domain Admin rights. Hyena is heavily used to access user?s hard disks / data and I believe is totally a wrong way. There are file/folders permission conflicts and very week or no security at all.

I have been hired recently and assigned the task to deal with this situation. I have never dealt with this type of situation, therefore, seeking help to overcome this problem and secure my job as well.

Personally, I would like to know:
? How to hide my pc from displaying on the network neighborhood? (I modified the registry but Hyena still can access it.
? How to know who is accessing my pc? I would like to block the entire administrator from accessing each other systems.
? Get notified whenever any person tries to access my pc.
? Control software installation (only administrators or with admin privileges persons should be able to do it.
? How to configure system to use admin privileges when installing software.
? Some techniques & tips to administrate file servers, security etc.

I know its lot but would appreciate your help as soon as possible.

12 replies

by rapidad

there is a cd available called nt resources, from microsoft. it has almost all of the abilities you have asked about. If your network and worstations were professionally installed, the disk should be there somewhere. There is also one for w2k but I like the nt4 disk better. Also as far as question 4,5 Terminal Services is your answer. I can send you info about corporate level security programs, but they are enterprise type solutions and carry a very hefty price tag. Do the readme's on the Server disk (you should have access to that software if they want you to perform those tasks), find the resource disks and do some more reading. Tip 1 hide your PC? remove it from the domain. take it to the workgroup (there doesnt actually need to be one)with the same name as your domain. If you dont know how to do this let me know. Tip 2 block administrator, sorry he very nature of an administrator is the ability and task of controlling the entire network. you either have an admin or you dont. tip 3 personal firewalls, i use ez trust from CA (where i work) and it is great. let me know if this helps or you want to discuss in more detail.

by timthetoolman

Hi,

I took a look at the Hyena product description and it looks like its a fairly nice application that simplifies many management tasks but it also looks like it sits over NT security rather than bypassing it.

Consequently I'd say its not Hyena at fault, rather you simply need to define and implement an effective security model across you domain.

so....

1. The need to hide the PC in the network neighbourhood wont be an issue when the other security measures are in place.

2. Whenthe other security measures are in place, entries will be made in the event logs for failed access attempts.

3. You wont get immediate popup messages, but periodically check the event logs to see who has been trying.... I believe there are tools around that will periodically scan the event logs for you but apart from the expensive "TNG" from Computer Associates, I dont know which ones offhand.

4. When you remove admin privs from everyone who doesn't need it, this will be covered....

5.This cant easily be done. You need to use a tool such as Microsoft's SMS (Systems Management Server) to enable software installations that in turn require admin privs without the client having the privs.

6. Should be covered separately. Its a bigquestion.

(continued...)

by timthetoolman

But for now here's a short discussion on what I believe is happening in your domain and what you can do to tighten it up.

As you said, it looks like up to 7 people have domain admin privs. First of all, you need to get to the point where you can remove those high level privs.

Do this by creating 7 new global administrative groups. Say... Administrator1, Administrator2, ..., Administrator7

Then add those 7 people into their respective group.

On each PC that they need to manage, add the appropriate AdministratorX group into the local administrators group.

Also ensure that the new administrator groups have the appropriate accesses on any servers.

Finally remove the 7 people from the domain administrators group.

That way, each administrator will be able to administer the PCs that they are meant to but no more.

Of course if all 7 people need to access all of your PCs then well... they may as well have domain admin rights although technically its still better to create another group (as above) for them.

Here is a site discussing the NT security model.

http://noyau.com/reference/serk/scwin_1.htm

(remove spaces from the above URL)

Also you need to remove all administrator rights from the regular user'saccounts on their PCs. But understand that the moment you do this, you'll need to begin installing all your clients' software so be prepared for a huge increase in work. You could grant the right "installer" to anyone who kicks up enough stink to allow them to install most software again.

Also enable auditing failed seurity access events.

Cheers,
Tim.

by ntexpert1

1. The First thing you should do is to change your computer name and then make changes in registry that will make your computer dissappear.

2. You can Open Start > Programs > Administrative Tools > Server Manager to see who is accessing your PC.

3. You can Use Start > Programs > Administrative Tools> User Manager for Domains and then from there you can set Auditing to see who tries tro access your files and at what time.

4. You can be notified at the same time from the same place.5. You can contact me at userid@rediffmail.com in case you wanna know more...

by shanghai sam

Hi
In my opinion to work with 7 persons with Domain Admin rights is a wrong way. These 7 persons must have specific/limited rights/jobs and only one person Domain Admin rights. In this maner with 7 Domain Admins is very hard to manage a network (how many computers and servers are there?). I think that you will have a lot of problems if you can't control who is MASTER.
You must discuss and establish who is "MASTER Domain Admin" and then change password for this account, create news accounts for "SLAVE Domain Admins" and give them only necessary rights to perform their job (or split network in 7 domains if you don't have other way and establish trust relationships between domains).
You must verify all groups and users to see what rights was set for these. Hyena can generate these reports (how many users are in this\these domain/s?). If is possible remove also local admin rights for users (allow only domain admin to logon local).
Establish a policy security which offer you an initial enviroment (how profiles works, app allowed on network, restrictions, etc).
Establish departments groups and shares for these with correct permissions. Try to establish one person for each department who can create folders and manage permissions in this share (or create you first 2 or 3 levels of directories). Don't use Everyone group. Replace it with Domain User or use defined groups.
Hope these give you some ideas.
Good luck

by joseph moore

Here is my 2 cents on this:
1) NET CONFIG SERVER /HIDDEN:YES
That will hide your system from the domain (not visible in Network Neighborhood), but your machine can still be mapped to and such. A better solution is for you to 1- make a local Admin account on your system, 2- log in as that local Admin and 3- remove your system from the domain and putting it in its own Workgroup.
2) Auditing, as mentioned before will help. Audit Successful and Failed Account Logon Events, Directory Service Access, Logon Events, & Object Access. If you are on a Win2KPro machine, then open Control Panel -> Administrative Tools -> Local Security Policy -> Security Settings -> Local Policies -> Audit Policy.
Another trick to try is to periodically run:
NET FILES
from a command prompt. That will list all open files, and who has them open.
3)You can set up an alert that scans your Security log for the logon event ID (I forget what it is right now, but once you start auditing Logon Events, you can checkout your log to get the ID number). Open Computer Management in the Administrative Tools section, go to Performance Logs and Alerts ->Alerts and select New Alert. You would then have the alert look in Security log for the logon event ID #, and have it notify you when a logon happens.
4) Dameware NT Utilities. www.dameware.com

I have to go, so I can't cover the last two (they are long answers and others have covered them)

hope this helps

This discussion is closed to new replies.