2

While installing a new XP machine that had not been connected to the domain I was browsing to a UNC path and was not prompted for authentication. I then went to the different mapped drives and found that I had full access to all files and folders on the network.

I was logged into the machine as a local administrator account that had the same name as a domain administrator. Could that have been the reason that I had unrestricted access using the local account on a machine that was not joined to the domain? If so what steps should I take to secure this.

In addition to this we have recently experienced the cryptolocker malware and it was able to encrypt files that the host user had no access too, so I suspect that the vulnerability mentioned above is related.

Improve this question
4
  • On the XP machine, prior to opening the mapped drives / UNC path, did you do anything else that asked you for domain credentials ?
    – ack__
    Commented Oct 23, 2013 at 18:34
  • I had not yet. I used a UNC path to open up a directory with automatic installs, and it had not prompted me for credentials. That's when i got curious and started to browse the entire network freely, across multiple file servers. I have not tried to reproduce this on another machine yet. I just disabled the builtin administrator in favor of a local user with local admin privileges.
    – user32364
    Commented Oct 23, 2013 at 18:40
  • I have to ask, are you sure those file servers are configured to restrict accesses correctly ?
    – ack__
    Commented Oct 23, 2013 at 18:58
  • 1
    haha, as soon as a domain user connects the restrictions apply. I believe that AviD has answered the issue below. Some Local admin have the same password as a domain admin. Will be correcting on this workstation and testing.
    – user32364
    Commented Oct 23, 2013 at 19:48

1 Answer 1

Reset to default
3

If the local user has the same password as the domain account by the same name, yes you will automatically be recognized on the remote servers as the same user, and thus have the elevated privileges.

This is known as "pass through authentication". The reason this works is because the security token is issued based on knowledge of the account's username and password - the domain is not regarded in this context (but obviously it is used as the authenticating source).
Still secure, though, since you obviously know the password...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .