Restricting service accounts that have administrator privileges

Restricting service accounts that have administrator privileges
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Restricting service accounts that have administrator privileges Matthew X. Economou 07-08-2007
Posted by S. Pidgorny on July 8, 2007, 4:49 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
The rights you looking for:

* Connect to computer from network
* Install software

It's not full admin. From the description, that is not required.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

>I have a service account with administrator rights that I would like
> to restrict to just performing software installs. The account needs
> to be able to copy files to the administrative shares on the target
> computer (servers and workstations), then execute the setup program
> via RPC. Once installed, the software will run as a service in the
> LocalSystem security context.
>
> How might I restrict the rights afforded to this service account? I
> realize that remote software installation is sufficient to compromise
> a computer, but I'd like to know if there's anything I can or should
> do to restrict what this account can access. (I'm probably better off
> using a different method for software distribution, but in this case,
> I am using a network-based discovery program to find computers that
> aren't running this service, and once discovered, the program pushes
> the service out to them using this account.)
>
> Best wishes,
> Matthew
>
> --
> "Rogues are very keen in their profession, and know already much more
> than we can teach them respecting their several kinds of roguery."
> - A. C. Hobbs in _Locks and Safes_ (1853)



Posted by Matthew X. Economou on July 9, 2007, 12:19 am
If you were  Registered and logged in, you could reply and use other advanced thread options

SP> Connect to computer from network

Is this sufficient to connect via the administrative shares (i.e.,
C$)? That's this program's only method of access to the target
computers.

Best wishes,
Matthew

--
"Rogues are very keen in their profession, and know already much more
than we can teach them respecting their several kinds of roguery."
- A. C. Hobbs in _Locks and Safes_ (1853)

Posted by Roger Abell [MVP] on July 9, 2007, 2:39 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Yes, that is sufficient, but from what you said previously
that is not the only way as the install also gets triggered.


>
> SP> Connect to computer from network
>
> Is this sufficient to connect via the administrative shares (i.e.,
> C$)? That's this program's only method of access to the target
> computers.
>
> Best wishes,
> Matthew
>
> --
> "Rogues are very keen in their profession, and know already much more
> than we can teach them respecting their several kinds of roguery."
> - A. C. Hobbs in _Locks and Safes_ (1853)



Posted by Matthew X. Economou on July 9, 2007, 10:42 am
If you were  Registered and logged in, you could reply and use other advanced thread options

SP> Connect to computer from network

How is this right relevant? According to Microsoft
(http://technet2.microsoft.com/windowsserver/en/library/f9c9ddb9-a7bf-4b1f-a0e3-376115c066bf1033.mspx),
"EVERYONE" (or "AUTHENTICATED USERS" at least) has this right by
default. I don't see how assigning this right to my service account
will grant any additional access to member computers.

SP> Install software

I'm not familiar with the "install software" user right, and I don't
see it listed in the policy editor. Is this some amalgamation of
existing rights? From what I can tell, one must be at least a member
of "Server Operators" or "Power Users" in order to be able to copy
files into %ProgramFiles%, and one must be a member of
"Administrators" in order to access the administrative shares. (I
haven't had time to analyze the permissions necessary to register
executables with the Service Control Manager, although I assume it
requires administrator rights.)

Thanks anyway.

Best wishes,
Matthew

--
"Rogues are very keen in their profession, and know already much more
than we can teach them respecting their several kinds of roguery."
- A. C. Hobbs in _Locks and Safes_ (1853)

Posted by S. Pidgorny on July 13, 2007, 8:10 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
1. It is relevant. Connect from the network is for accessing CIFS resources
and IPC$. It is relevant - you can restrict that so only admins can access
remotely. That is the default for terminal services but not for CIFS.
2. Yes.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *

>
> SP> Connect to computer from network
>
> How is this right relevant? According to Microsoft
>
(http://technet2.microsoft.com/windowsserver/en/library/f9c9ddb9-a7bf-4b1f-a0e3-376115c066bf1033.mspx),
> "EVERYONE" (or "AUTHENTICATED USERS" at least) has this right by
> default. I don't see how assigning this right to my service account
> will grant any additional access to member computers.
>
> SP> Install software
>
> I'm not familiar with the "install software" user right, and I don't
> see it listed in the policy editor. Is this some amalgamation of
> existing rights? From what I can tell, one must be at least a member
> of "Server Operators" or "Power Users" in order to be able to copy
> files into %ProgramFiles%, and one must be a member of
> "Administrators" in order to access the administrative shares. (I
> haven't had time to analyze the permissions necessary to register
> executables with the Service Control Manager, although I assume it
> requires administrator rights.)
>
> Thanks anyway.
>
> Best wishes,
> Matthew
>
> --
> "Rogues are very keen in their profession, and know already much more
> than we can teach them respecting their several kinds of roguery."
> - A. C. Hobbs in _Locks and Safes_ (1853)



Similar ThreadsPosted
HPSBMA02385 SSRT080161 rev.1 - HP Service Manager (HPSM), Gain Extended Privileges November 12, 2008, 2:21 pm
HPSBUX02332 SSRT080056 rev.1 - HP-UX running Apache with PHP, Remote Denial of Service (DoS), Gain Extended Privileges May 6, 2008, 10:17 am
HPSBUX02332 SSRT080056 rev.2 - HP-UX Running Apache With PHP, Remote Denial of Service (DoS), Gain Extended Privileges May 19, 2008, 6:30 pm
HPSBUX02153 SSRT061181 rev.2 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) November 30, 2006, 3:15 pm
HPSBUX02153 SSRT061181 rev.3 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) March 6, 2007, 6:26 am
HPSBUX02156 SSRT061236 rev.2 - HP-UX Running Thunderbird, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) March 21, 2007, 2:29 pm
HPSBUX02153 SSRT061181 rev.4 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) July 23, 2007, 10:16 am
HPSBUX02153 SSRT061181 rev.5 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) September 4, 2007, 10:21 am
HPSBUX02156 SSRT061236 rev.3 - HP-UX Running Thunderbird, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) September 4, 2007, 10:23 am
HPSBUX02156 SSRT061236 rev.4 - HP-UX Running Thunderbird, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) January 8, 2008, 7:59 am

The site map in XML format XML site map

Contact Us | Privacy Policy