Pupil changing passwords on a limited user...help!

[sidnuts]

We have a suite of 10 standalone pc’s, with vista business and steadystate 2.5 installed, with 1 admin and 3 limited users. One of the teachers mentioned this morning that a pupil has changed the administrator’s passwords…checked the pc’s and sure enough he has gone around on a number of pc’s and changed the Admin passwords. After an interrogation from one of the teachers, he actually admitted to using the command prompt, but wont say much else.

The only way I know of changing the password via command prompt is using the ‘net user’ command. But this shouldn’t work as command prompt has been disabled and he was logged in on a limited user.

Does anybody else know of another way somebody could change the admin passwords on a limited user?

Any help would be definitely appreciated.

[cookie_monster]

1 This user was definitely logged on as a restricted and doesn't know the admin password?

2 Are the boxes fully patched?

3 Is it possible that they booted the PC to a utility CD or USB drive?

[sidnuts]

Thank you for the quick response, all of the pc's have the latest updates etc.. Only 3 of us know the admin password (hopefully) Just had another look at 1 of the PC's with admin password that have been changed and it looks as if he managed to enable the guest user. Been googling for about an hour now to work this one out with no luck.

[sidnuts]

Found out how he did it, little monkey...hats off to him though

[ces973]

Are there any extra accounts on the PC?

We had a student last year create a text file, rename it with a .bat extension, and then ran it. The file created a local admin account, to which the student logged into and deleted our admin accounts. Unfortunately, at the time I had all of our logon scrips as .bat files, so I couldn't block access to the command prompt.

[sidnuts]

He opened a folder, typed computer, when the window opened, vista displays a link called 'open control panel', he clicked that, enabled the guest user, ran command prompt and changed the admin password using the net user command.

Cant believe I missed that one, disabled control panel for all users...hopefully that should sort it. I would have thought steadystate would has disallowed creation of new users, maybe I missed something whilst I was configuring it.

At least no damage was done.

[cookie_monster]

Are you sure? A guest user should not have access to reset an admin password no matter what method they use?

[sidnuts]

I'm not 100% that he did it that way, but I did disabled boot to usb/dvd etc, disabled safemode. His teacher made him show me how he did it, I must have made the guest account and administrator by mistake.