|
A client on a company can run commands and view the Group Policy settings applied to his own account and computer. The commands are:
In my opinion, telling a user what is being enforced upon him can have a minor flaw, as the security administrators will sometime prefer obscurity when it comes to internal users, not knowing what is their security level etc. Is viewing applied group policy on a client PC not considered a minor security breach? |
||||
|
|
|
In general, in a corporate environment, the rules under which staff should operate should be very transparent, as should the controls which enforce these rules. Being able to view the group policy is rarely a security breach as it shouldn't be leaking information which is meant to stay hidden. The valuable part of the policy is the enforcement of permissions and access etc. Security through obscurity is generally a bad thing in corporate environments (as well as many others) as it doesn't actually provide security against attackers or against accidental breaches. |
|||
|
|
|
Users not knowing their permissions is security-by-obscurity at best, and it may actually turn out to be a bigger security risk, bottom line. Users want to get things done, that's what they're paid for. If they can't, there are two possible scenarios: a) Users run into obscure problems ("I saved a file there and there, and it just disappears"), they try to "solve" them on their own and become creative, possibly introducing all sorts of security and maintenance nightmares. b) Users run into problems, but can find out that they lack permission to do what they want; typically, they will go see whoever is in charge of security and request that they be given suitable permissions, at which point it is possible to step in and either grant those permissions in a sane way, or show them the proper way to achieve their goals. Also, if being able to view one's own effective permissions makes a system vulnerable, then the permissions are either flawed, or not properly enforced. After all, an attacker doesn't need to check permissions, (s)he can simply try to do what it is they want and see if it succeeds. Viewing someone else's permissions is a different story though: it means that once you have broken into a non-privileged account, you can quickly find out which other accounts are most valuable for you (administrative permissions, access to interesting files, etc.) and then mount a targeted attack specifically for those users. |
|||
|
|
