RabbieBurns Posted May 11, 2011 Posted May 11, 2011 It has been brought to my attention today, that students can get to pretty much all the server admin stuff. They use the mmc.exe program, and then they are able to add snap-ins such as AD, DHCP, printers, pretty much everything. Im not sure how long this has been going on as Ive not long taken over this network, but how can I stop them from doing this???
RabbieBurns Posted May 11, 2011 Author Posted May 11, 2011 i mean, what do i put in the software restriction policies? where do i get the hash from?
mounters Posted May 11, 2011 Posted May 11, 2011 Don't use a software restriction policy, go to User Config -> Policies -> ADM templates -> Windows Components -> MMC and configure it all there. 3
Tricky_Dicky Posted May 11, 2011 Posted May 11, 2011 It's in User Configuration - > Administrative Templates - > System ->don't run specified Windows applications. Enable that and put mmc.exe in it and away you go 2
Tricky_Dicky Posted May 11, 2011 Posted May 11, 2011 Don't use a software restriction policy, go to User Config -> Policies -> ADM templates -> Windows Components -> MMC and configure it all there. Never noticed that before, that's much simpler. Thanks for the info.
NikChillin Posted May 11, 2011 Posted May 11, 2011 Stop them from running ANY .exe's or you will have no network!
mounters Posted May 11, 2011 Posted May 11, 2011 Stop them from running ANY .exe's or you will have no network! Hmm, yes becuase if you stop all exes then you'll have a really useful network?!? What about basic things like winlogon.exe, explorer.exe, winword.exe calc.exe, paint.exe notepad.exe
ChrisMiles Posted May 11, 2011 Posted May 11, 2011 You'd be supprised what you can do with just domain user permissions. Users can, for example, edit certain fields on their own AD user, which is pretty annoying. However, when it comes to MMC stuff, they obviously don't have permissions to modify anything, they can, however, view almost anything, however, one question does present itself: Why do you have the AD management tools installed on the student computers in the first place? Anyway, regardless of what MMC snapins you deny, they can still use VBScripts or powershell to access data on pretty much anything if they really wanted to.
Steve21 Posted May 11, 2011 Posted May 11, 2011 It has been brought to my attention today, that students can get to pretty much all the server admin stuff. Out of curiosity, Any reason they can even see the exe's to run? Aren't all items like "run", control panel, etc etc be locked down in first place? So even if MMC is runnable, there's no way to it. Just seems a bigger issue that it's accessible, than it's being run If that makes sense? Steve
RabbieBurns Posted May 11, 2011 Author Posted May 11, 2011 ok thats them locked out. Thanks heaps for that. Is there anything else I should be thinking of about policies for the students a major as this?
Steve21 Posted May 11, 2011 Posted May 11, 2011 ok thats them locked out. Thanks heaps for that. Is there anything else I should be thinking of about policies for the students a major as this? Well for one, as mentioned above. Why can they even access it as it is? Seems like something's missing/adrift. Steve
RabbieBurns Posted May 11, 2011 Author Posted May 11, 2011 Out of curiosity, Any reason they can even see the exe's to run? Aren't all items like "run", control panel, etc etc be locked down in first place? So even if MMC is runnable, there's no way to it. Just seems a bigger issue that it's accessible, than it's being run If that makes sense? Steve all of the above are blcoked, but they still have access to the C: drive (which im trying to have blocked too... red tape...)
RabbieBurns Posted May 11, 2011 Author Posted May 11, 2011 You'd be supprised what you can do with just domain user permissions. Users can, for example, edit certain fields on their own AD user, which is pretty annoying. However, when it comes to MMC stuff, they obviously don't have permissions to modify anything, they can, however, view almost anything, however, one question does present itself: Why do you have the AD management tools installed on the student computers in the first place? Anyway, regardless of what MMC snapins you deny, they can still use VBScripts or powershell to access data on pretty much anything if they really wanted to. These are just basic windows 7 enterprise installations. The AD pack hasnt been installed seperately.
NikChillin Posted May 11, 2011 Posted May 11, 2011 Hmm, yes becuase if you stop all exes then you'll have a really useful network?!? What about basic things like winlogon.exe, explorer.exe, winword.exe calc.exe, paint.exe notepad.exe OK. from outside Program files I mean
RabbieBurns Posted May 11, 2011 Author Posted May 11, 2011 You'd be supprised what you can do with just domain user permissions. Users can, for example, edit certain fields on their own AD user, which is pretty annoying. However, when it comes to MMC stuff, they obviously don't have permissions to modify anything, they can, however, view almost anything, however, one question does present itself: Why do you have the AD management tools installed on the student computers in the first place? Anyway, regardless of what MMC snapins you deny, they can still use VBScripts or powershell to access data on pretty much anything if they really wanted to. also, when i tested with a user account, they were able to modify AD, I changed the displayname of a teacher account..
Steve21 Posted May 11, 2011 Posted May 11, 2011 all of the above are blcoked, but they still have access to the C: drive (which im trying to have blocked too... red tape...) Block it, block it nowwww! Steve
CyberNerd Posted May 11, 2011 Posted May 11, 2011 also, when i tested with a user account, they were able to modify AD, I changed the displayname of a teacher account.. Surely this is a permissions error? Whats stopping anyone with an openLDAP client and valid domain credentials logging in and doing the same?
webman Posted May 11, 2011 Posted May 11, 2011 Whats stopping anyone with an openLDAP client and valid domain credentials logging in and doing the same? Hopefully, software restriction policies to prevent the running and installation of foreign executables and software
Steve21 Posted May 11, 2011 Posted May 11, 2011 Surely this is a permissions error? Whats stopping anyone with an openLDAP client and valid domain credentials logging in and doing the same? Unless it's being run as local admin. In a weird way. But yeah without sounding rude, if they can access, C:\, run any exe, Full admin tools, and edit AD etc. Kind of says there's something majorly wrong with the restrictions in place. (If there are any?) Might be worth checking all the restrictions to see what's missing, as I know you said you took over recently. Better iron them out in advance, than catching up Steve
p858snake Posted May 11, 2011 Posted May 11, 2011 also, when i tested with a user account, they were able to modify AD, I changed the displayname of a teacher account.. Check what user groups they are in.... Are you sure they aren't domain admins? (yes i've seen schools like that).... Personally I would take away every group apart from the default users group and start rebuilding.
CyberNerd Posted May 11, 2011 Posted May 11, 2011 Hopefully, software restriction policies to prevent the running and installation of foreign executables and software Unless it's being run as local admin. In a weird way. But yeah without sounding rude, if they can access, C:\, run any exe, Full admin tools, and edit AD etc. Kind of says there's something majorly wrong with the restrictions in place. (If there are any?) Might be worth checking all the restrictions to see what's missing, as I know you said you took over recently. Better iron them out in advance, than catching up Steve You seem to be implying that it wouldn't be safe to run user owned equipment (iphones,blackberrys,linuxes etc) in an Active Directory environment incase they run a 3rd pary LDAP tool? An openLDAP server (ie a linux Domain server) doesn't suffer from this problem. Is windows insecure? should I ditch AD? or is it a permission error on the AD like I stated ?
Steve21 Posted May 11, 2011 Posted May 11, 2011 You seem to be implying that it wouldn't be safe to run user owned equipment (iphones,blackberrys,linuxes etc) in an Active Directory environment incase they run a 3rd pary LDAP tool? An openLDAP server (ie a linux Domain server) doesn't suffer from this problem. Is windows insecure? should I ditch AD? or is it a permission error on the AD like I stated ? Don't know where you read that at all. Not that I mentioned anything at all to do with anything you just said.... (And if you read my post I didn't quote webman anywhere)
cpjitservices Posted May 11, 2011 Posted May 11, 2011 I'd also be blocking things in a GPO to stop access to things like CMD and Regedit. Have you checked make sure they are blocked ?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now