Windows 7 sethc.exe hack

[Darylrese]

Hi everyone,

 

A delightful student at my school has managed to reset the local admin password by performing the sethc.exe hack which brings up a command prompt at the login page when activating sticky keys (shift 5 times) in windows 7.

 

Luckily my technician caught him doing it on monitoring software.

 

Anyone know how to prevent this? Can I just put a machine policy on to prevent sticky keys?

[xenonive]

http://www.edugeek.net/forums/security/134119-sethc-exe-hack.html

[Bste93]

We had the same thing happen, luckily the student didn't do anything malicious! We've disabled sticky keys and got a script running on start up to check the file size of sethc.exe as per the attached post. I believe we also disabled start up repair.

[jonspurs]

How did you disable Sticky Keys?

[Darylrese]

Registry hack I think. That plus I disabled f8 boot menu and locked down BIOS to disable boot from all external media

[jonspurs]

Cheers. Is there a security risk wirh F8 boot menu? I tried and it asks for admin credentials. I'm guessing you used "bcdedit /set {bootmgr} displaybootmenu no"?

[Darylrese]

Well we never use safe mode or setup repair...it's quicker to image the machine as a rule so I just disabled it.

 

I believe one way of gaining access to perform this 'hack' is by entering setup repair. I have also disabled the accessibility options button on the logon screen.

 

No doubt they will still find a way round it all

[ITGuyWestMidlands]

How do you disable the accessibility options please?

[Darylrese]

Computer Configuration > Windows settings > Security settings > File System select new and point to c:\windows\system32\Utilman.exe

 

Change permissions on USERS, SYSTEM and Administrator to DENY.

 

Apply GPO and reboot PC's. The button is still visible but doesn't do anything when clicked.

[ITGuyWestMidlands]

Ah ok. A bit messy but will do the trick. Thanks for that