4 ms·
As the article mentions, the threat model here is primarily an insider one, with a "rogue" user leveraging this method to obtain capabilities the domain adminis
by throwanem 7y ago
As the article mentions, the threat model here is primarily an insider one, with a "rogue" user leveraging this method to obtain capabilities the domain administrator intends to deny. There are certainly more effective exploits for an outside attacker to use, but that's beside the point.
- gruez 7y ago>As the article mentions, the threat model here is primarily an insider one, with a "rogue" user leveraging this method to obtain capabilities the domain administrator intends to deny What would be those capabilities? They'd have to be user-level policies, which already limits what you could do.
- dfox 7y agoUser Group Policy isn't exactly a security mechanism, it exists to prevent users from unintentionally breaking their profile. There is multitude of ways how the user in question can inject arbitrary code into processes that are affected by user group policy as these processes are owned by that user.