计算机网络安全与管理：第20讲 Windows系统安全管理.pptVIP

* ? WinLogon and NetLogon - WinLogon handles local logons at the keyboard and NetLogon handles logons across the network. * * * Privileges are systemwide permissions assigned to user accounts, such as the ability to back up the computer, or to change the system time. There are over 45 privileges in Windows Vista. Some privileges are deemed “dangerous” which means a malicious account that is granted such a privilege can cause damage. Examples include: ? Act as part of operating system privilege. This is often referred to as the Trusted Computing Base (TCB) privilege, because it allows code run by an account granted this privilege to act as part of the most trusted code in the operating system: the security code. This is the most dangerous privilege in Windows and is granted only the Local System account; even administrators are not granted this privilege. ? Debug programs privilege. This privilege allows an account to debug any process running in Windows. A user account does not need this privilege to debug an application running under the user’s account. Because of the nature of debuggers, this privilege means a user can run any code he or she wants in any running process. ? Backup files and directories privilege. Any process with this privilege will bypass all access control list (ACL) checks, because the process must be able to read all files to build a complete backup. Its sister privilege Restore files and directories is just as dangerous because it will ignore ACL checks when copying files to source media. * * Consider the DACL. Objects that require protection are assigned a DACL (and possible a SACL), which includes the SID of the object owner (usually the object creator) as well as a list of access control entries (ACEs). Each ACE includes a SID and an access mask. An access mask could include the ability to read, write, create, delete, modify, and so on. Note that access masks are object-type specific; for example, services (the Windows equivalent of UN