Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security measure? I am not quite sure how this all ties into the registry / SAM & other files.. So would someome still be able to use a program like ONTPRE and add in an administrative password to the SAM file or log in by some other means? (Through sniffing or other means.. I assume the other means would generally be easier, if they exist)

In a nutshell, this is my question: The question is it still possible to reset the SAM file or some other method to get onto the computer without accessing the domain?

share|improve this question
2  
What is your question exactly? If you disable password caching it means the user would have to have access to the domain in order to log into their windows account. In order to get into an account with administrator powers, one would have to first, log into an account that had administrator powers. This requires the username and password. –  Ramhound Jan 25 '12 at 19:31
    
The question is if it is still possible to reset the SAM file or some other method to get onto the computer without accessing the domain. –  ekaj Jan 26 '12 at 13:12

1 Answer 1

up vote 2 down vote accepted

is [it] still possible to reset the SAM file or some other method to get onto the computer without accessing the domain?

Of course. If you have physical access to the machine, you always have the ability to reset the local security database with known password values, thus giving yourself access. This is due to the very design of the PC architecture and cannot be changed, no matter what operating system you are using.

But this would be local access to all data stored on the local machine - you would not have any online domain resources available. You would still need valid domain account credentials for that.

The risk for accessing the "data at rest" (i.e. data which is persistent even when the operating system is not running) can be alleviated by using encryption mechanisms which are tied to user input or removable keys (like smartcards) - for example with EFS.

share|improve this answer
1  
You could also enable BitLocker on Vista and above to provide full disk encryption. –  Nasko Jan 26 '12 at 17:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.