|
Posted by karl levinson, mvp on July 24, 2006, 9:13 am
If you were Registered and logged in, you could reply and use other advanced thread options
>I have encountered a major security issue when creating a desktop shortcut
>to
> a so-called secure Windows server.
Windows is only secure when securely configured. I strongly suspect this
"issue" has more to do with your configuration than with a security issue in
Windows. There is no way Windows could have existed for three or more years
without someone else discovering an issue like this.
You didn't tell us what version of Windows you're running. Is it Windows
2003?
> I have also managed to map the server as a drive in
> Windows Explorer without logging in to the server.
If your local account and password on the workstation also exist on the
server or in the domain, then you'll be granted access.
Windows could also be caching your user login credentials via a previous
mapped drive. Before you map the drive, do you see anything when you run
the NET USE command at a command prompt?
I also wonder if Windows is caching the files locally for when the server is
unavailable. On Windows XP, this feature is viewed under Tools, Folder
Options.
> The account from which the shortcut was
> created has limited privileges associated with it.
Limited privileges where? On the local workstation? Or on the files and
network share being used on the server?
> On opening the shortcut,
> the user is not prompted for secure logon and the user has full privilges.
What permissions does that user have on the Windows network share being used
to access those files?
By "full," I assume you mean read/write/modify/delete? Can the user also
change permissions on the files?
> Even when the user account was deleted
> from the server this problem persisted.
I would suggest enabling auditing on the Windows server and on those files
to confirm what user account is being used to access those files:
http://securityadmin.info/faq.asp?auditing
> It also persists at multiple Windows
> stations. This implies that a user need only know the server name to get
> access to that server.
Windows does not do this by default, unless you've intentionally configured
it to do so. Is the Guest account configured, for example?
| 
XML site map