• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Security war in full swing! Help me survive! Updated!

R

Ramma2

Platinum Member
Ok so I sort of provoked a security type war between myself and a couple of the other IT guys here in the office. I noticed that they left their default admin c$ share running and had the Remote Registry service running, so I set up their PCs to play a boopee doopee doopdeedoop clip from Banaphone every time they opened, closed, minimized or maximized apps on their PCs.

Of coure retaliation was swift! I've been able to hold them off so far by disabling the above, and removing the Domain Admin account from my PC, but the one area I'm worried about is the MMC plugin, where they can right click their My Computer icon, choose manage, then connect to my pc, where they could easily start or stop services.

Anyone know how to disable their access to this option?

I'll also take any advice on what else to lock down!

(I have domain admin rights, so no I'm not some user who is doing stuff I shouldn't. This is all in fun)

UPDATE:

So at the end of the night last night I was able to change their backgrounds by using the admin share and putting my own background image in their profiles, overwriting what ever they had set for their desktop image. It was great, I had struck another blow!

Then when I came in this morning my PC was off. An obvious ploy to get me to log in and run a login script. I disconnected from the network, logged in, reconnected and removed the nefarious script. They tried to blame it on a power outtage but of course I was not fooled as my test server at my desk was still up and running.

I then noticed they had moved my PC to a seperate container in AD. I countered my changing the name of my PC to something that would blend in with the other computers in our building, and they wouldn't be able to find it.

They then put my actual user account in a seperate container, and proceeded to group policy me into oblivion. No rights, no icons, no start menu, and a barbie wallpaper. I recovered by logging out and in as Admin and putting my user back where it was supposed to be.

At this point a truce was called, we had determined that eventually we'd be running on DOS boxes disconnected from the network just to get some work done. I had to finish up by writing a batch script to change their backgrounds again (since they had figured out to lock out the admin share) and did a bit of social engineering to get them to run it. They did and will come into work tomorrow with bright pink backgrounds that say Truce... For now...

Muahaha!
 
If you run a firewall and just block all inbound to your worksation, no one can initiate a connection to your machine, so none of those vulnerable services will be available.

Because thay are local to you, they will still be able to intercept your traffic and forge replies, but that is much more difficult than script kiddy brute force attacks on the file sharing ports.
 
If they have access to it physically, there is nothing you can do. I could modify your registry, change files, etc., by just having access to it while you aren't there. You would discover your machine rebooted if it was logged on and locked. You would know when I did it, but not what. Oh, you think that BIOS password will work? Jumper...

So, just surrender 😛

Oh, and you have remote management and distribution, you might disable those in your little war. You may not want to explain it.
 
If they know the local admin account you're screwed, they'll get in when you're not there. To prevent them from remotely accessing your machine fire up the local group policy editor, under computer config, windows settings, security settings, local policies, user rights assignment there is an item named "Deny access to this computer from the network". Modify that policy to deny any accounts you think they may use.
 
Updated bump!

My next question is how to still be connected to the domain, and not allow group policy to take effect on my PC.

Not sure if its even possible.
 
Originally posted by: Ramma2
Updated bump!

My next question is how to still be connected to the domain, and not allow group policy to take effect on my PC.

Not sure if its even possible.
Click to expand...
My advice, don't go there. Raduque noted what happened at his work. At ours, you would be on the forensic watchlist. You do not want to be on that list.

And again, just surrender. Like I said, if they have access to your machine, you are owned. Using tools regularly recommended in the OS forum, I can do anything to your machine while you are not there. ANYTHING. Well almost anything as I cannot read encrypted files.

 
To be connected to a domain and not allow GPOs would be an absolutely worthless scenario. It would ruin the entire point of GPOs. The only thing you can do is move your machine into a GPO by itself that other admins do not have access to. Once there, they cannot move it back out and cannot modify GPO policies to it. But if you are all domain admins of that AD domain, such a container won't exist and it's pretty much a waste of time.

The thing is, everything you guys are "attacking" on is pretty standard stuff, C$ D$ and Admin$ are very useful administrative shares. Domain Admins should be in the administrators group on every machine. And GPO policies are supposed to function. Once you start breaking these things, you create a larger security risk because you now have a machine that can not easily be fixed if contaminated. Eh...
 
just put a shutdown command in their startup and be done with it. Heck have it shut down the other guy too while you're at it.


A "Security War" between domain admins is like a war in the middle east... there is no end to it and there can be no defense and no winners.
 
Originally posted by: Smilin
just put a shutdown command in their startup and be done with it. Heck have it shut down the other guy too while you're at it.


A "Security War" between domain admins is like a war in the middle east... there is no end to it and there can be no defense and no winners.
Click to expand...

Exactly the conclusion we have arrived at. A cease fire has been called, and I am researching other methods of warfare.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top