Questions about passwords?

[orphic]

I like the option to have VNC use the windows logons as it's password, but I don't like that the local admin has to have access in WinXP. Am I not reading that right or is there no way to not give the local admin rights to VNC? I would like it that only domain admins can VNC. That makes it a little less damaging if someone were to find the local admin password.

If that's not possible, is it possible to rotate the VNC password with a logon script, or a command line way to do it at all?

[Marscha]

Use "New MS-Logon" (MS-Logon II).
Then you can configure groups/users which are allowed to access the computer via UltraVNC.
You can configure only the Domain Admins to have this right.

But you should keep in mind that any Local Admin can change this configuration and add the Local Admin group to the access list.
We consider this not a bug. A Local Admin is supposed to control the computer.

[orphic]

So are you saying that local admins do not inherently have access on WinXP running as a service? I must be confused then because I read, "local admins always have access".

The issue is we are a school and as much as we lock things down students are increasingly clever in cracking the computers (it's like a hobby), anyway the local administrator password is vulnerable just by being stored on computer at all, where the domain admin password is not.

My other question is when I'm using MS Logon, do I need "accept socket connections" turned on?

[ipsec]

So are you saying that local admins do not inherently have access on WinXP running as a service? I must be confused then because I read, "local admins always have access".

The issue is we are a school and as much as we lock things down students are increasingly clever in cracking the computers (it's like a hobby), anyway the local administrator password is vulnerable just by being stored on computer at all, where the domain admin password is not.

On this note if you arent already doing this - change the local admin account names to something very.. very... unusuall.. since the computer is part of a domain technically you could test out disabling the local admin account.. of course losing your backdoor in if the computer never had an authorized user connect caching its credentials for re-login during network outages. But as people poke and prod, your best bet is to safeguard everything you can..

My other question is when I'm using MS Logon, do I need "accept socket connections" turned on?

If you dont have accept socket connections (Anyone please correct me if Im wrong) It will not listen to the port you specify, basically disabling the service.

Dont know what kind of school you are with, but if someone can plug into your network, and get a DHCP address and not be challenged at all.. it wouldnt be a bad idea.. if you got some good wizkids on your hands... to use the DSM encryption plugin - and disallow access to the VNC Folder for normal users to even list the contents.

-only reason I say this is... if they can log in with a protocol analyzer and pick up your domain credentials over your network.. you may get rooted... and thats not fun if you have kids "Testing" things.

just my $0.02

[Marscha]

In MS-Logon I it was true that "local admins always have access".
This changed when it was modularized: [post=5307][/post]
Just remove authadmin.dll.

In MS-Logon II just the groups/users that are configured have access.