!! students have access to active directory, everything !!

[CyberNerd]

Don't know where you read that at all. Not that I mentioned anything at all to do with anything you just said....

(And if you read my post I didn't quote webman anywhere)

 

Sorry I thought the thread was saying that you should lock MMC as it was an unsafe application ?!?

I don't think the problem here is with MMC, CMD or regedit - they need not be restricted because the permission on AD should be enough to stop users changing names etc on other people accounts!

[RabbieBurns]

@Steve21 they are running local profiles here with documents and desktop redirected to their server (win7/8r2), how will restricting access to C: effect local profiles?

 

@CyberNerd makes sense. where would I look about access to AD? The students are only members of a students group, domain users, and a graduating year group. How would I audit if they have anyone has any special permissions? They're obviously not domain admins or anything like that..

[CyberNerd]

@CyberNerd makes sense. where would I look about access to AD? The students are only members of a students group, domain users, and a graduating year group. How would I audit if they have anyone has any special permissions? They're obviously not domain admins or anything like that..

 

I'm guessing security settings in ADSIEdit. I couldn't tell you what to set though....

[p858snake]

Actually, when you changed the display name... Was that in a AD users and computers that you brought up on the client machine or was that in something like "search -> Users and computers"?

[RabbieBurns]

was within the mmc with the ad snapin added

[p858snake]

May sound silly... but just to double check, did you log into the server and make sure that its been changed in AD U&C?

[RabbieBurns]

yes

[ChrisMiles]

also, when i tested with a user account, they were able to modify AD, I changed the displayname of a teacher account..

 

All users have permissions to update this information for their own user account in AD, it is by design. It includes most of what is on the front page of the user properties screen as well as addresses and such. There is no way to prevent this without using ADSI edit to remove permissions and modifying the schema.

[CyberNerd]

All users have permissions to update this information for their own user account in AD, it is by design. It includes most of what is on the front page of the user properties screen as well as addresses and such. There is no way to prevent this without using ADSI edit to remove permissions and modifying the schema.

 

but not other peoples accounts?, which I thought was the problem here...

[RabbieBurns]

yes, a student was able to change a teacher account. Im looking at ADSIEdit but not sure what I should be looking for? Anyone able to point me in the right direction.

[ChrisMiles]

yes, a student was able to change a teacher account. Im looking at ADSIEdit but not sure what I should be looking for? Anyone able to point me in the right direction.

 

If your students can update other peoples user accounts then either your AD permissions are completely and utterly borked in a way that could only be caused by buggering about with adsiedit or your students are somehow in the Domain Admins or similar group.

 

Try useing the vbs script below to recursively check a specific user to see what groups they are in:

 

Command: cscript script.vbs ""

 

Dim objGroupList, objUser, strDN

' Check for required argument.
If (Wscript.Arguments.Count < 1) Then
   Wscript.Echo "Required argument  missing. " _
       & "For example:" & vbCrLf _
       & "cscript EnumUserGroups.vbs cn=User2,ou=Sales,dc=MyDomain,dc=com"
   Wscript.Quit(0)
End If

' Bind to the user object with the LDAP provider.
strDN = Wscript.Arguments(0)
On Error Resume Next
Set objUser = GetObject("LDAP://" & strDN)
If (Err.Number <> 0) Then
   On Error GoTo 0
   Wscript.Echo "User not found" & vbCrLf & strDN
   Wscript.Quit(1)
End If
On Error GoTo 0

' Bind to dictionary object.
Set objGroupList = CreateObject("Scripting.Dictionary")

' Enumerate group memberships.
Call EnumGroups(objUser, "")

Sub EnumGroups(ByVal objADObject, ByVal strOffset)
   ' Recursive subroutine to enumerate user group memberships.
   ' Includes nested group memberships.
   Dim colstrGroups, objGroup, j
   objGroupList.CompareMode = vbTextCompare
   colstrGroups = objADObject.memberOf
   If (IsEmpty(colstrGroups) = True) Then
       Exit Sub
   End If
   If (TypeName(colstrGroups) = "String") Then
       ' Escape any forward slash characters, "/", with the backslash
       ' escape character. All other characters that should be escaped are.
       colstrGroups = Replace(colstrGroups, "/", "\/")
       Set objGroup = GetObject("LDAP://" & colstrGroups)
       If (objGroupList.Exists(objGroup.sAMAccountName) = False) Then
           objGroupList.Add objGroup.sAMAccountName, True
           Wscript.Echo strOffset & objGroup.distinguishedName
           Call EnumGroups(objGroup, strOffset & "--")
       Else
           Wscript.Echo strOffset & objGroup.distinguishedName & " (Duplicate)"
       End If
       Exit Sub
   End If
   For j = 0 To UBound(colstrGroups)
       ' Escape any forward slash characters, "/", with the backslash
       ' escape character. All other characters that should be escaped are.
       colstrGroups(j) = Replace(colstrGroups(j), "/", "\/")
       Set objGroup = GetObject("LDAP://" & colstrGroups(j))
       If (objGroupList.Exists(objGroup.sAMAccountName) = False) Then
           objGroupList.Add objGroup.sAMAccountName, True
           Wscript.Echo strOffset & objGroup.distinguishedName
           Call EnumGroups(objGroup, strOffset & "--")
       Else
           Wscript.Echo strOffset & objGroup.distinguishedName & " (Duplicate)"
       End If
   Next
End Sub

[teejay]

Could this thread be moved to Security or somewhere that doesn't get indexed by the search engines please.

[Dos_Box]

Could this thread be moved to Security or somewhere that doesn't get indexed by the search engines please.

 

I don't think there is anything yet, that warrants it as it is not a topic about how to get around security measures, but rather one of how to create them.

[RabbieBurns]

Try useing the vbs script below to recursively check a specific user to see what groups they are in:

 

Doesnt seem to work for me?

 

D:\profiles\rabbieburns\Desktop>cscript check_user.vbs
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.

D:\profiles\rabbieburns\Desktop\check_user.vbs(14, 44) Microsoft VBScript compilation error: Expected end of statement

[ChrisMiles]

Doesnt seem to work for me?

 

D:\profiles\rabbieburns\Desktop>cscript check_user.vbs
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.

D:\profiles\rabbieburns\Desktop\check_user.vbs(14, 44) Microsoft VBScript compilation error: Expected end of statement

 

Are you sure you copied the whole script including the last End Sub line?

[p858snake]

Have you tried RSOPing a student?, could have someone done a restricted groups and added them to the domain admins?

[RabbieBurns]

Have you tried RSOPing a student?, could have someone done a restricted groups and added them to the domain admins?

 

would this not show up when i look at 'members' when looknig at the domain admins group?

[p858snake]

iirc (havn't played for awhile) it won't because its a group policy so it basically "fakes" them being added to the group.

 

Or if the students have access to the command prompt you can use whoami (i think in seven you need to pass "whoami /groups" for the listing) to just grab the groups that they have and it should show it.

[Michael]

I think (more than likely) users have been added to the domain administrators group. There's no way they could access and change so much!

 

I would check the 'Students' or 'Teachers' Security Groups haven't been added. Adding Software Restriction Policies isn't the answer to solving these issues.

[RabbieBurns]

Are you sure you copied the whole script including the last End Sub line?

 

ok my bad, sorry i guess copying and pasting over rdp doesnt work too great.

 

So ive now ran it against a couple of random student users. It appears there is a 'strange group' which the Students group is a member of.

 

When going into ADSIEdit and looking at this 'strange group', in the security tab under 'Authenticated Users', and 'SELF' there are a whole load of permissions set:

 

Read, Send to, Read exchange info, read exchange personal info, read phone and mail options,

 

Understanding ASIEdit a bit more than I did earlier, under Security of random students, there is an 'Everyone' which has the permission to change password.

 

@micheal, unless thats been done through a policy and isnt showing up in AD groups, as @p858snake has suggested..

[RabbieBurns]

right I'm still not really got to the bottom of this. Ive blocked them out of MMC by the aforementioned method in GP. Ive also audited the group policies they are being applied and there isn't anything I an see that would give them that access in AD.

 

Ive also tried this with a bunch of the different models of machines we have round school. It seems the AD tools is only installed on a small batch. So Ive got them set to re-image.

 

But it doesn't address the issue of why they were able to modify AD the first place though..

 

edit: Further investigation - it seems it is only 1 teacher account that the students are able to modify the name, display name etc etc. Im obviously not able to test every account, but all the main ones they cant modify. Also, they cant change group membership which is good. Question no is why an they change this 1 teacher account?

 

And also, I dont know why they can see AD at all, or is this just the way AD works that any user account can query AD (via 3rd party tools etc?)

Edited May 13, 2011 by RabbieBurns

[Steve21]

But it doesn't address the issue of why they were able to modify AD the first place though..

 

Is it all students who can access it or only a few? Is it worth creating a new test student, and checking if they get the permissions, or if it's a few users who've added it to themselves accounts?

 

Steve

[RabbieBurns]

i chose a random year 5 student that im doing my testing with. Its able to change the diplay name of this teacher and other info, but not modify groups etc

[RabbieBurns]

Ok a few things to update this. Ive had one of the students in question down to show me how they were being able to view AD, and this was the method:

 

Quickly Search Active Directory from the Desktop

 

How can I block that? Can I disable them from running that exe via GP.

 

Also, it still doesn't explain why they can change the settings of a teacher, but it seems to be limited to just a single teacher, so I think I might just delete them and recreate them.

 

Also we are running at 2003 functional level so Im going to ditch the 2003 DCs and upgrade to 2008R2 functional level..

 

Also, is there a way of removing the ability of non-admins from joining machines to the domain?

Edited June 6, 2011 by RabbieBurns

[p858snake]

Also, is there a way of removing the ability of non-admins from joining machines to the domain?

Yes, it's a gp somewhere, i will look it up later if someone doesn't beat me.