3 ms·

Microsoft considers this kind of escalation a security issue and will issue patches if this is found in Windows components. If Steam is installed on a corporate

by r1ch 7y ago

Microsoft considers this kind of escalation a security issue and will issue patches if this is found in Windows components. If Steam is installed on a corporate network PC (game development, QA services, esports teams, etc?), regular users being able to elevate to machine admin is a big deal.

AnIdiotOnTheNet 7y ago
> Microsoft considers this kind of escalation a security issue and will issue patches if this is found in Windows components. Makes sense, because Windows is also used for servers. The Steam client is not. > If Steam is installed on a corporate network PC (game development, QA services, esports teams, etc?), regular users being able to elevate to machine admin is a big deal. No it isn't. This is effectively the same as being installed on some home PC. Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account. A non-administrative process still has access to all the user's stuff, and all the network resources that user account has access to. Local admin doesn't really give you anything new.
- deleted 7y ago
  [deleted]
  - deleted 7y ago
    [deleted]
- lurker458 7y ago
  local admin on windows is similar to having sudo rights on linux. It can be used to access personal files and running sessions of other users on the same machine, to install malware that will affect other users, to change drivers, to block AV or GPO policies from being applied to protect them, etc.
  - delfinom 7y ago
    Local admin just makes the life of IT guys more difficult. It's why we don't give it out to your typical "worker drone" employees because they'll manage to install many flash players that want to admin escalate....
    - AnIdiotOnTheNet 7y ago
      I've found the opposite, that for the most part people just want to be able to do their job and sometimes they need administrator rights for that, and it is incredibly annoying and frictionful if they need to contact IT every time. Since workstations are almost always 1:1, we don't consider whatever advantages local admin might provide an attacker to be worth the extra friction caused by disallowing it.
- thw0rted 7y ago
  > Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account That's dangerously untrue. On all the Windows systems at home, everybody else is a non-privileged user and I set sane file permissions so they can get to shared movies, etc, but not read my bank details and tax records. Privilege escalation means that they could trivially change those permissions. The same is true of a corporate environment -- just because you can't also make changes to AD doesn't mean the threat of accessing local files under other users' accounts is trivial. ETA: I just read a bunch of this user's other posts in this thread and I'm beginning to suspect they're trolling, so I'll disengage.
  - AnIdiotOnTheNet 7y ago
    > On all the Windows systems at home, everybody else Ok, in that scenario it is true, but multi-user desktops in the age of smartphones and tablets are a vanishingly small niche. My experience in corporate environments suggests they are also almost entirely 1:1 as well.

by r1ch 7y ago

AnIdiotOnTheNet 7y ago

> Microsoft considers this kind of escalation a security issue and will issue patches if this is found in Windows components. Makes sense, because Windows is also used for servers. The Steam client is not. > If Steam is installed on a corporate network PC (game development, QA services, esports teams, etc?), regular users being able to elevate to machine admin is a big deal. No it isn't. This is effectively the same as being installed on some home PC. Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account. A non-administrative process still has access to all the user's stuff, and all the network resources that user account has access to. Local admin doesn't really give you anything new.

deleted 7y ago
[deleted]
- deleted 7y ago
  [deleted]
lurker458 7y ago
local admin on windows is similar to having sudo rights on linux. It can be used to access personal files and running sessions of other users on the same machine, to install malware that will affect other users, to change drivers, to block AV or GPO policies from being applied to protect them, etc.
- delfinom 7y ago
  Local admin just makes the life of IT guys more difficult. It's why we don't give it out to your typical "worker drone" employees because they'll manage to install many flash players that want to admin escalate....
  - AnIdiotOnTheNet 7y ago
    I've found the opposite, that for the most part people just want to be able to do their job and sometimes they need administrator rights for that, and it is incredibly annoying and frictionful if they need to contact IT every time. Since workstations are almost always 1:1, we don't consider whatever advantages local admin might provide an attacker to be worth the extra friction caused by disallowing it.
thw0rted 7y ago
> Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account That's dangerously untrue. On all the Windows systems at home, everybody else is a non-privileged user and I set sane file permissions so they can get to shared movies, etc, but not read my bank details and tax records. Privilege escalation means that they could trivially change those permissions. The same is true of a corporate environment -- just because you can't also make changes to AD doesn't mean the threat of accessing local files under other users' accounts is trivial. ETA: I just read a bunch of this user's other posts in this thread and I'm beginning to suspect they're trolling, so I'll disengage.
- AnIdiotOnTheNet 7y ago
  > On all the Windows systems at home, everybody else Ok, in that scenario it is true, but multi-user desktops in the age of smartphones and tablets are a vanishingly small niche. My experience in corporate environments suggests they are also almost entirely 1:1 as well.