Kids messing in DOS prompt after F8 safe mode with networking...

[kennysarmy]

Have some students doing some testing for me.....

 

They have discovered (and I have verified) that if they boot into safe mode with networking by pressing f8 they can then use the "Windows Help and Support" window that is open by default to click "Diagnostic tools to use in safe mode" - one of which is "Click to open Command Prompt".

 

They have then been able to hunt around and find security groups etc.

 

I am not sure what damage they could cause if any - but would rather block this hole if possible.

 

Could I create a policy that prevents HelpPane.exe from running in my security group policy.

 

Does anyone block the F8 options? or edit them somehow so kids cannot mess?

[6Foot2]

Haven't seen this problem myself so a quick Google of the topic gives this page as the second result:

 

Link: Microsoft: Windows XP Pro - disable safe mode

 

Doing this is not recommended. Proceed at your own risk!

 

Click on the Start Button

Select Run

Type in "regedit" and hit OK

Expand the left hand side to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot

Under SafeBoot, you should now see Minimal and Network. Click on them and hit F2 to rename them to "Minimal-" and "Network-", respectively.

This should cause Windows to crash the next time it is booted into Safe Mode."

 

If you can quickly redeploy your stations [imaging/Rebuilding] I suppose you could experiment with theis technique on one machine to see how it works out for you?

Edited March 15, 2011 by 6Foot2
Correct spelling mistake.

[Michael]

When the kids are pressing F8 and going into Safe Mode, how are they logging in? Correct me if I am wrong, but I don't think you can logon to a domain from Safe Mode.

 

A simple solution is to rename the local administrator account and you can do this via a GPO:

 

Computer Config > Windows Settings > Security Settings > Local Policies > Security Options -

 

Accounts: Rename administrator account

Accounts: Rename guest account

 

In 2008 Server you can also change the administrator password completely using GPP (Group Policy Preference). Another alternative (what I normally do) is make these changes just before you take an image. It's all done for you from the start

[Arthur]

You could do what RM do on CC3 and disable the mouse and keyboard while in Safe Mode. Microsoft even have a KB article which mentions this.

 

DisableSafeModeMouseAndKeyboard.reg

Windows Registry Editor Version 5.00

; Delete mouse driver for safe mode
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

; Delete keyboard driver for safe mode
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

 

EnableSafeModeMouseAndKeyboard.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

 

 

DisableSafeModeMouseAndKeyboard.vbs

On Error Resume next

Dim WSHShell
Set WSHShell = WScript.CreateObject("WScript.Shell")

' Delete mouse driver for safe mode
WSHShell.RegDelete "HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}\"
WSHShell.RegDelete "HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}\"
WSHShell.RegDelete "HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}\"
WSHShell.RegDelete "HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}\"

' Delete keyboard driver for safe mode
WSHShell.RegDelete "HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}\"
WSHShell.RegDelete "HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}\"
WSHShell.RegDelete "HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}\"
WSHShell.RegDelete "HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}\"

Set WSHShell = Nothing

Edited March 15, 2011 by Arthur

[Michael]

Nice little script you have there Arthur

[kennysarmy]

When the kids are pressing F8 and going into Safe Mode, how are they logging in? Correct me if I am wrong, but I don't think you can logon to a domain from Safe Mode.

 

A simple solution is to rename the local administrator account and you can do this via a GPO:

 

Computer Config > Windows Settings > Security Settings > Local Policies > Security Options -

 

Accounts: Rename administrator account

Accounts: Rename guest account

 

In 2008 Server you can also change the administrator password completely using GPP (Group Policy Preference). Another alternative (what I normally do) is make these changes just before you take an image. It's all done for you from the start

 

If we boot in to safe mode with networking we are able to logon on our test windows 7 pc.

Edited March 15, 2011 by kennysarmy

[kennysarmy]

There is another thread I have found on this topic:

http://www.edugeek.net/forums/windows/2939-disable-f8-now-3.html#post647374

 

However that suggests the keys to edit are in the currentcontrolset - your script and reg files edit the set001 and 002 - do you know why the difference?

[Michael]

If we boot in to safe mode with networking we are able to logon on our test windows 7 pc.

 

I'm a little surprised by this, as the built in administrator account in Windows Vista is disabled by default. You can only logon with a user who's a member of the local administrator group. I have no reason to believe Windows 7 is any different.

 

The built in administrator account can be re-enabled, but of course you need to be logged in with another local administrator account to perform the net user command.

 

Windows XP on the other hand always has an administrator account created and in most cases with a blank password.

[Arthur]

However that suggests the keys to edit are in the currentcontrolset - your script and reg files edit the set001 and 002 - do you know why the difference?

By editing ControlSet001 and 002 you are effectively editing CurrentControlSet anyway.

[kennysarmy]

I'm a little surprised by this, as the built in administrator account in Windows Vista is disabled by default. You can only logon with a user who's a member of the local administrator group. I have no reason to believe Windows 7 is any different.

 

The built in administrator account can be re-enabled, but of course you need to be logged in with another local administrator account to perform the net user command.

 

Windows XP on the other hand always has an administrator account created and in most cases with a blank password.

 

I don't think this has anything to do with administrator accounts....the little darlings are logging in with their normal domain account - which seems possible if you boot using F8 in to safe mode WITH networking.....

 

Thanks.

[enjay]

Possibly missing something here, but if they're logging in, won't GPOs kick in and prevent things like command prompt from running anyway? Or does Safe Mode bypass GPOs?

[Marci]

Reading around a bit, Local Policies are applied in SafeMode with networking under Win7, but Group Policies aren't.

(eg: Restrict access to Safe Mode)

[siuko]

we are looking into this at the moment...

 

our plan is just to delete the minimal and network reg folders completely

 

this makes the computers restart when you choose safemode hehe

 

if we need safemode back for admin purposes we can just merge the keys back in