What are some ways to mitigate the time-of-check-to-time-of-use issues that apply to Windows permissions?
- End-user is added to the local Administrators group in order to install software, printers, etc.
- The user's account is removed from the Administrators group while the user is logged in.
- The change in permissions will not apply until the user's next login.
- The user, with Administrator rights still applied, adds themselves back to the Administrators group before logging off - reversing the removal.
- The next time the user logs in, they still have Administrator permissions until they are (and stay) removed again.
Aside from just not granting Administrator rights to end-users in the first place (obvious solution), or by any other means that require specific end-user actions, what are some ways the above scenario (or similar Windows-inherent TOCTTOU issues) can be prevented?