Home page logo
/

basics logo Security Basics mailing list archives

Re: Spying in a corporate environment
From: Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>
Date: Thu, 22 Nov 2007 16:47:36 +0100

On 2007-11-22 Mario DeBono wrote:
If you have a 2003 domain enforce group policies and restrict access
to certain windows components. I presume even if a user has admin
rights on a pc, he should not be able to over right the group
policies, if he is not so keen to remove the policies from the pc
himself.

You're mistaken. A local admin can override policies (at the very least
for a short while until they are reapplied), and even if that wasn't
possible (s)he can always log on locally, in which case domain policies
don't apply at all. The only way to control users with local admin
privileges is to revoke their local admin privileges. Everything else
are futile efforts.

Regards
Ansgar Wiechers
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault