NICE AdminTowards running windows as non administrator.ppt

NICE AdminTowards running windows as non administrator by Ruben Gaspar Michel Christaller Windows Desktops IT/IS HEPIX Fall 2005 Overview Why Nice Admin implementation Deployment Conclusions Reasons to run as No Admin Running as non-admin limits your exposure Zero day exploits For developers: developing software as User instead of Admin helps ensure that software will run correctly on end-users systems Emulate Unix concept “su” Proof of concept, windows terminal service experience Built-in possibilities Fast User switching on WXP (not possible on domain computers) Accounts with blank password on WXP are not so bad (better than with a weak password): can only be used to log on the console no network access can’t be use via RunAs Collision with Domain security policies RunAs May be a problem running msi runas /profile /env /user:administrator msiexec /i yourfile.msi Using a local admin account: Programs running as local admin can’t access network resources runas /user:%COMPUTERNAME%\Administrator runas /netonly /user:%USERDOMAIN%\%USERNAME% cmd.exe Per-user settings apply to the local Administrator’s profile NICE Admin In three steps: Adds your current account to the local Administrators group Forks a new process via an Advapi32.lib method CreateProcessWithLogonW (it creates a new logon session and builds a new security token, taking into account group memberships in effect at that instant) Removes your current account from the local Administrators group NICE Admin at a glance NICE Admin Components NiceAdmin Windows application – User’s desktop /help, /startin, /console, /iexplorer, /timeon, /timeoff, /toggle, /winstatus… searches for suitable application to run an specific type of file HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess HKCU\Software\CERN\NiceAdminWin enabling logging Nice Runas Service - User’s desktop Charge to add/remove the account to the local administrators group It listens at port