Runas security problem

[Bert Smith]

Please take a look at
http://cert.uni-stuttgart.de/archive/ntbugtraq/2003/07/msg00068.html and
http://silverstr.ufies.org/blog/archives/000208.html. Any comments? Please
address any replies to the news group. My email address is false. Thanks
Bert Smith

 

[Rick \Nutcase\ Rogers]

This group is for support for users having specific issues looking for
assistance in resolving them, it's not a chat room. If you wish to discuss
the security concerns behind the savecred function, find an appropriate
security newslist or blog.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone

 

[Bert Smith]

Hi
My apologies. I had intended to use the /savecred switch on my network and
came across the articles mentioned in my original post. I consider this
problem to be a XP security problem well worth mentioning in a XP newsgroup.
I wanted to see what others thought about it and if there was a fix.
Apparently, there is no work around. Naturally I will not be using it,
despite the inconvenience of not doing so. Please address any replies to
the news group. My email address is false. Bert Smith

 

[David Candy]

It's purpose is to allow administrators to use a limited account normally and to elevate themselves for specific tasks. So it's hardly a problem or security issue. You wanted to misuse it.

 

[Rick \Nutcase\ Rogers]

You didn't ask if there was a workaround, you asked for commentary on the
articles. That invites discussion, and is not a request for assistance. As
you've stated, there isn't a workaround. As David has stated, it's not
intended for use such as you have suggested. You will need to create a user
group with the appropriate permissions for your network, not use the
/savecred switch for limited accounts.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone

 

[Bert Smith]

Hi Guys
Many thanks for the replies. They are appreciated. I did NOT want to
misuse it, only understand the implications of using it. Have a nice day.
Please address any replies to the news group. My email address is false.

Bert Smith
It's purpose is to allow administrators to use a limited account normally
and to elevate themselves for specific tasks. So it's hardly a problem or
security issue. You wanted to misuse it.