RE: [Full-disclosure] Flaw in Microsoft Domain Account CachingAllows--Local Workstation Admins to Temporarily Escalate-Privileges--andLogin as Cached Domain Admin Accounts (2010-M$-002)

From: David Gillett <gillettdavid@fhda.edu>
To: 'Thor (Hammer of God)' <thor@hammerofgod.com>,'George Carlson' <gcarlson@vccs.edu>,bugtraq@securityfocus.com,full-disclosure@lists.grok.org.uk
Cc:
Subject: RE: [Full-disclosure] Flaw in Microsoft Domain Account CachingAllows--Local Workstation Admins to Temporarily Escalate-Privileges--andLogin as Cached Domain Admin Accounts (2010-M$-002)
Date:


> If I take the domain admin out of my local administrators, they can't do
anything.  Done.

  Back when I did AD/domain support, all domain user accounts got a profile
that included a trivial script to re-add Domain Admins to the Local Admins
group.  So this kind of local removal shenanigans lasted only until the user
next logged into the domain.

David Gillett





Copyright © 1995-2018 LinuxRocket.net. All rights reserved.