Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This trick to hack windows and reset passwords(or create new logins)has been around for ages and still works on windows 7 and windows 8. Is there any way to disable the key combination that brings up the 'Ease of access' dialogue box WindowsKey+U?

I've got other safeguards in place like full disk encryption and a locked down BIOS so people can't boot CD so easily, but those are possible to circumvent with relative ease, especially if I leave my computer turned on and running unattended for long periods of time.

share|improve this question
    
If the BIOS is locked down, how would someone boot from a DVD/USB? –  AdnanG Sep 17 '13 at 4:37
    
@AdnanG reset the Bios with the convenient button on the back of my motherboard, or one of the additional 2 ways to do it from inside my case. –  NULLZ Sep 17 '13 at 6:59
    
Yeah but this option will raise suspecion in a work place. –  AdnanG Sep 17 '13 at 7:05
add comment

2 Answers

up vote 5 down vote accepted

You're very wrong in your last assumption; full disk encryption is not "possible to circumvent with relative ease". It is especially not "possible to circumvent with relative ease" to reach the goal of this workaround IF you're behaving securely.

As you've probably figured out by now, this is a physical-access problem. If somebody has physical access to your machine, they don't really need the utilman.exe trick. They can simply modify your SAM file. In this case, they went with a less technical method. Nevertheless, they're both possible through the same vulnerability - unauthorized physical access.

Assuming you're using full-disk encryption solutions like TrueCrypt, let's examine the two possible scenarios:

  • You left your computer turned off and unattended for ages: The attacker won't be able to do anything to modify the structure of your files (copy cmd.exe as utilman.exe) or modify your SAM file.

  • You left your computer locked: A determined adversary can eventually (although not easily) recover your encryption keys and access/modify your system, including but not limited to the trick you mentioned and modifying the SAM file.

As you can see, any unauthorized full access will lead to the, expected, compromise of your system. The utilman.exe is not your problem. You're looking into the wrong corner.

share|improve this answer
add comment

Application specific group policies or local policies might be your answer.

See this link for details.

share|improve this answer
    
Actually, this is wrong. This prevents that specific exe from running, but if you replace it with another .exe it will not apply those permissions. –  NULLZ Sep 17 '13 at 7:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.