NetworkGeezer Posted May 30, 2006 Posted May 30, 2006 Students can deactivate PC monitoring software by booting Windows into Safe Mode with Networking. Audience: This 'advisory' is for those of you who use PC monitoring/control software which relies on a agent on the student PC that is implemented as a windows service. Affected software: all Windows versions of ABControl, Impero, NetOP, Net Support, SynchronEyes, Securus etc. Vulnerability details: When Windows boots into Safe Mode it does not start third party services. As the client agents for most PC remote control/monitoring software are implemented as a Windows service, they will not run during a safe Mode session. By choosing Safe Mode with Networking a student can perform a domain log on and use Internet Explorer and other programs while outside the control of a teacher PC. NT Based versions of Windows do not allow control of the F8 troubleshooting menu. Mitigation: Safe Mode only has a VGA screen resolution (640x480 by 16 colours) which may be uncomfortable for and hence deter most students users. Students will only have the access rights they have during a normal window session. If they are members of the \Users group they will not be able to modify any files or registry settings outside their own profile. If you have webfiltering via a seperate proxy computer (ISA+Websense or Linux+Squid+Dansguardian) then students will not be able to load any webpages that they would not normally have access to. Workarounds:Create a login script which logs off the user if it detects the environment variable SafeBoot_Option=Network Windows 2000 does do not have a builtin logoff command so you may have to download the LOGOFF.EXE from the Windows 2000 Resource KIT Rename or delete the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\ Network\DHCP Renaming at least allows later reactivation by an administrator under one of the other Safe Mode options Use a hex editor to manually edit NTLDR to deactivate the dectection of F8 keypress. Warning: Changing system files directly is very dangerous. Make sure you can recover your Windows Installation and user data from backup.
ChrisH Posted May 30, 2006 Posted May 30, 2006 There is a modified NTLDR on the net for this but its frowned upon as you arent allowed to alter it really. 1
NetworkGeezer Posted May 30, 2006 Author Posted May 30, 2006 There is a modified NTLDR on the net for this but its frowned upon as you arent allowed to alter it really. I wouldn't trust it anyway. The problem with the NTLDR method is that it inolves physical access to each machine. To do whole school would ruin my halfterm schedule.
indie Posted May 30, 2006 Posted May 30, 2006 The problem with the NTLDR method is that it inolves physical access to each machine. To do whole school would ruin my halfterm schedule. Yes yes, and mine. Id have to stop being at home watching Futurama. Good news everyone!
NetworkGeezer Posted May 30, 2006 Author Posted May 30, 2006 The registry edit is probably the most effective as the logout option may fall prey to the same problem as other GPOs, the RJ45 yank.
Ric_ Posted May 30, 2006 Posted May 30, 2006 The registry edit is probably the most effective as the logout option may fall prey to the same problem as other GPOs, the RJ45 yank. You could always copy the script to the local machine and run it from there. The patch-yank should then not affect the script running.
NetworkGeezer Posted May 30, 2006 Author Posted May 30, 2006 Didn't think of that TBH. I'm going for a reg edit in a GPO startup script. The lockdown should be in before the kids are back. Get out of that one you little ****s :angry1:
Gatt Posted May 30, 2006 Posted May 30, 2006 I'm for getting several lengths of MDF, some yale/mortice locks, hinges, screws/nails & fans - then encasing all the base units inside them and nailling the monitors to the MDF that should stop a lot of problems
john Posted May 30, 2006 Posted May 30, 2006 Done that for one area, and TBH they then just murder the keyboards and mice so its a loosing battle
NetworkGeezer Posted May 30, 2006 Author Posted May 30, 2006 Nailing the monitors to the MDF? Wouldn't that reduce the picture quality somewhat
john Posted May 30, 2006 Posted May 30, 2006 I prefer to use these - http://www.cclonline.com/product-info.asp?product_id=3447&category_id=301&manufacturer_id=0 Great bits of kit they are.
Gatt Posted May 30, 2006 Posted May 30, 2006 Nailing the monitors to the MDF? Wouldn't that reduce the picture quality somewhat Lol - not what I meant but would be funny to see!!
ChrisH Posted May 30, 2006 Posted May 30, 2006 Depending on your profile setup you can put a login script in the local profile to log people off if that profile is used eg when the network is disconnected.
ajbritton Posted May 30, 2006 Posted May 30, 2006 I can't think of any piece of software that needs F8. Why not just destroy the F8 key on all your keyboards;-)
ChrisH Posted May 30, 2006 Posted May 30, 2006 I can't think of any piece of software that needs F8. Why not just destroy the F8 key on all your keyboards;-) Ah so all along the kids were trying to help me out by destroying the "F" keys
Gatt Posted May 31, 2006 Posted May 31, 2006 ^wish the kids here just did that - there seems to be some black market for key caps in the swinton area judgung from the number that go missing on a regular basis. What I would give for keyboards where the caps cant be removed *or re-arranged* and at an affordable price!
speckytecky Posted May 31, 2006 Posted May 31, 2006 I have no experience of the other monitoring packages mentioned but have found that with SynchronEyes if Win XP workstations have Windows Firewall enabled this also disables SynchronEyes. Geoff
NetworkGeezer Posted May 31, 2006 Author Posted May 31, 2006 Most monitoring software require exceptions to be made in XP firewall so that the teacher computer can initiate communications. I think the general advice is to keep the firewall operational just in case there is a zeroday worm in the wild and in case students have discovered a teachers laptop password.
Gatt Posted May 31, 2006 Posted May 31, 2006 Hopefully our virus problems will be limited to removeable media now as i have blocked all internet access except for authorised educational related websites Everything else is like this Just need to stop the buggers nicking and/or destroying my hardware now
Andrew_C Posted May 31, 2006 Posted May 31, 2006 Am I missing something here? Yep you want to block Safe Mode for the kids, but what do you do if the machine needs attention from you? Just re-RIS or whatever?
NetworkGeezer Posted June 1, 2006 Author Posted June 1, 2006 Am I missing something here? Yep you want to block Safe Mode for the kids, but what do you do if the machine needs attention from you? Just re-RIS or whatever? The block is on Safe Mode with Networking. You should still be able to get on to normal safemode (i,e. SafeBoot_OPTION=Minimal). You can then re-enable networking if you wish fro the purpose it was intended for. That's if you do it using the reversible methods like the regedit or the logon script. If you change NTLDR then there is no easy way back.
Geoff Posted June 1, 2006 Posted June 1, 2006 Careful editing windows program files like NTLDR. You're in breach of the EULA that'll cause all your licenses to be invalid.
NetworkGeezer Posted June 1, 2006 Author Posted June 1, 2006 Oh that's nice. They stop you from solving a problem they created. :angry4:
Norphy Posted June 1, 2006 Posted June 1, 2006 Hopefully our virus problems will be limited to removeable media now as i have blocked all internet access except for authorised educational related websites Everything else is like this Just need to stop the buggers nicking and/or destroying my hardware now You're whitelisting the Internet?! I'm amazed you haven't been chased out of the school by people waving flaming torches and pitchforks!
Gatt Posted June 1, 2006 Posted June 1, 2006 Hopefully our virus problems will be limited to removeable media now as i have blocked all internet access except for authorised educational related websites Everything else is like this Just need to stop the buggers nicking and/or destroying my hardware now You're whitelisting the Internet?! I'm amazed you haven't been chased out of the school by people waving flaming torches and pitchforks! Lol! I'll find out on Monday when the buggers return - they are bound to complain about the fact that they cant search for the status of Wayne "The Muppet" Rooney's broken meta-tarsal
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now