4 ms·
Is this a real concern? I always treat User Settings overridable, because they happen either in security context of user or within user registry which lives in
by jve 7y ago
Is this a real concern?
I always treat User Settings overridable, because they happen either in security context of user or within user registry which lives in %userprofile% - the user has full access to ntuser.dat file.
IMHO for real security stuff, Computer Settings are way to go.
> Some exploits may be able to drop a file somewhere on the Windows filesystem as non-admin. If the exploit dropped a “%USERPROFILE\ntuser.man”, with an autostart registry key to execute a file off of a remote SMB share, then the exploit now gained reliable code execution simply by dropping one non-executable file.
Well, if malicious guy can write your %USERPROFILE% folder, it's already no-go. You could potentially plant powershell profile scripts etc.
> By dropping an empty ntuser.man file in %userprofile%, ProfSvc will fail to load registry and thus prevent the user from logging in
You've already got bigger problems if someone can write %userprofile%
- ocdtrekkie 7y agoI wonder how many sysadmins truly think about User Settings that way. They should, but I imagine when people are trying to apply a setting to a group of people, and they feel those permissions should follow them regardless of what PC they are on, they would just think to make it a user setting.
- GordonS 7y agoI work for a mega corp, and many security-related policies are indeed set at the user, rather than machine, level. Even ones that apply to everyone, no idea why. They also enabled the "disable registry editing" policy, but for obvious reasons this only prevent the official regedit app from running, so anyone with local admin can edit the registry using a different app. I feel like I'm pushed in the direction of wasting my time figuring out ways to bypass what I see as silly restrictions - why would you disable registry editing for a developer? Why would you force credentials to be entered every time the UAC prompt is shown? The list goes on...
- Dylan16807 7y ago> the user has full access to ntuser.dat file How so? It's always open and locked when you're logged in, isn't it?