Alun
Thu Nov 11 17:01:10 CST 2004
"spence" <spence@discussions.microsoft.com> wrote in message
news:1B76339A-7F76-4E36-8732-CA91C124582B@microsoft.com...
>I have an employee who apparently has a way of cracking local
>administrative
> passwords. I just learned of this and he has thus far been using this
> trick
> "for good" (e.g. to by-pass corporate buracracies that impede
> productivity.)
> Regardless, I've asked him to cease this practice. However, I'd like to
> know
> if there's a way to make sure he's no longer able. The problem is that I
> don't know how he's done it except that I was told by a coworker that a
> floppy disk of some sort was invovled. I realize that's scant information
> to
> go on, but I was hoping that someone might be able to offer some guidance
> on
> shoring up the security on my PCs.
I've heard of this trick - you go up to the system administrator and you say
"you know those pictures you hoped would never get out? Well, I've got a
copy of them on this floppy disk, so hand over the passwords".
Okay, seriously, there's a number of possibilities at play here, and it
depends on what you mean by "cracking local administrative passwords".
The floppy disk mention suggests a password reset disk -
http://support.microsoft.com/?id=305478 if you're not in a domain, and
http://support.microsoft.com/?id=306214 if you are.
There's also a possibility that the floppy is a boot floppy that he uses to
run some small program that loads up NTFSDOS or some other driver to allow
him access to the system, and he runs some super-duper cracking routine.
This would seem rather unlikely. I'm still going with my suggestion of the
password reset disk.
Or maybe he's installed a keylogger, and the floppy is where he keeps the
program that allows him to read the keylogger's data.
There are other suggestions, and some of them verge on the outlandish -
doubtless you'll read many of them here.
Want to make it so that he's no longer able to do this? Remove his floppy
drive. Of course, he could then attach a USB external floppy, so you should
also fill his USB ports with epoxy resin to prevent that. Note that I am
being serious - these suggestions sound very flippant, but really physical
barriers are the only antidote to physical access problems.
Essentially it boils down to the fact that you can do anything with a
computer if you can get into the same room as that computer, with your
tools, and spend however much time you need.
An article on physical security can be found at
http://www.microsoft.com/technet/community/columns/5min/5min-203.mspx, and
an article on the basic laws of security is at
http://www.microsoft.com/technet/archive/community/columns/security/essays/10imlaws.mspx -
particularly "Law #3: If a bad guy has unrestricted physical access to your
computer, it's not your computer anymore".
When you provide an employee with a machine, that machine becomes "theirs"
in the sense that they can do almost anything to it, up to and including
pounding it with a sledgehammer until every part can fit through a
letter-box - and the only guaranteed way to prevent that is to not provide
them with the machine in the first place. There is a dance of trust that
you must engage in with your employees - you must let them know what they
are allowed to do, and what they are not allowed to do, and if they
demonstrate that they are willing to go outside those ranges, you have to a)
observe those infractions, and b) enforce sanctions that are intended to
deter such infractions.
I have yet to see a convincing argument that software can ever be developed
that will prevent someone from using physical access to override security.
Alun.
~~~~