Say What? Disable the local admin account?

re: Say What? Disable the local admin account?

Dennis — Fri, 14 Jul 2006 13:21:04 GMT

When you disable the local admin account it's still accessible when you boot in safe mode.

re: Say What? Disable the local admin account?

rob — Fri, 14 Jul 2006 21:30:54 GMT

Also, the default for a Windows domain (and correct me if I'm wrong) is to cache the last 10(?) logins and store the hashes in the registry. If the network is not available you can still login to the domain with the cashed credentials.

Interesting Finds: July 14, 2006

Jason Haley — Sat, 15 Jul 2006 06:13:52 GMT

re: Say What? Disable the local admin account?

Dennis — Sat, 15 Jul 2006 08:34:40 GMT

Rob,

Sometimes a computer account gets corrupt. When this happens the cached credentials also won't work.

But like i said. Reboot in safe mode and the local admin account is enabled.

re: Say What? Disable the local admin account?

Keith Combs — Sat, 15 Jul 2006 23:00:24 GMT

Yea, you have to be careful about cached creds. Depending on your factory staging process and the imaging used, cached creds may not be present.

Regarding safe mode, if you are an enterprise admin and have physical access (sitting in front of the machine), hopefully you'll know what the local admin password is if it's a standard build from your corporate desktop standard.

Lots of ifs...

If you give the user the admin password because they are far away, you let the genie out of the bottle.

re: Say What? Disable the local admin account?

rob — Tue, 18 Jul 2006 15:40:18 GMT

I didn't mention it but cached creds is actually a security risk. I've been told that you're supposed to set password caching to 0 on office PCs and 1 on Laptops. Makes sense. What happens when there's a problem? The tech nerd shows up and logs in with the Domain Admin password and now that's sitting on their pc where it can be easily extracted and attacked. (I've done this before on my network while doing a security sweep).
Thankfully, there's always safe mode, which really underscores the old saying "without physical security there is no system security".