Pupils trying to hack

[ron]

Hi, does anyone have any idea how a pupil could of changed the profile/settings on a pc as when a pupil logs on they don't get the profile they should, instead they get admin interface. I have rebuilt the pc to resolve this issue but I am interested to know how they managed to bypass the correct profile.

[LosOjos]

Is it restricted to a certain machine or to certain logins?

[siuko]

We always find the easiest way is to pull the network cable after login....

[computer_expert]

Maybe they are using the old 'yank the lan cable out during login' trick to get admin profiles

 

http://www.edugeek.net/forums/security/49064-login-then-pull-out-network-cable-admin.html

[K.C.Leblanc]

The usual method is to pull out the network cable out during log on or to log on, log off, remove network cable and log on again.

 

There's GPO which prevents this, but I can't remember it off the top of my head.

[ron]

Is it restricted to a certain machine or to certain logins?

 

All accounts get the admin profile on this pc in question, after a rebuild the issue is resolved. I may try the network cable unplug trick to see if this is what they have done. Does anyone know of any other little tricks they may try to be as naughty as possible? We have had some pupils trying to hack the webfilter but we managed to prevent that. It's always good to be one step ahead of them!!

[ron]

Actually if a pupil trying the trick of pulling out the network cable to bypass GPO surely this wouldn't apply once they had logged off and the network cable was connected again. The network cable was in place on this pc and I tried 5 different pupil profiles and they all came up without the pupil policy!

[Arcath]

They might have used that trick to get in as admin and then added YOURDOMAIN/Pupils to the local admins group?

[siuko]

Try running a group policy report on the computer and then users that are getting the admin access to see what GPO's are effecting them

[Guest salan]

We replaced tthe local default profile with a copy of the student profile. Seems to of stopped a lot of this.

But we had a machine the other day that although it was the students profile, it would let them through the SW box to anything.

Not sorted that one out yet. we just replaced the box. I didn't want to re image it juast yet as curious what they have done.

Alan