1

This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security measure? I am not quite sure how this all ties into the registry / SAM & other files.. So would someome still be able to use a program like ONTPRE and add in an administrative password to the SAM file or log in by some other means? (Through sniffing or other means.. I assume the other means would generally be easier, if they exist)

In a nutshell, this is my question: The question is it still possible to reset the SAM file or some other method to get onto the computer without accessing the domain?

2
  • 2
    What is your question exactly? If you disable password caching it means the user would have to have access to the domain in order to log into their windows account. In order to get into an account with administrator powers, one would have to first, log into an account that had administrator powers. This requires the username and password.
    – Ramhound
    Jan 25 '12 at 19:31
  • The question is if it is still possible to reset the SAM file or some other method to get onto the computer without accessing the domain.
    – cutrightjm
    Jan 26 '12 at 13:12
2

is [it] still possible to reset the SAM file or some other method to get onto the computer without accessing the domain?

Of course. If you have physical access to the machine, you always have the ability to reset the local security database with known password values, thus giving yourself access. This is due to the very design of the PC architecture and cannot be changed, no matter what operating system you are using.

But this would be local access to all data stored on the local machine - you would not have any online domain resources available. You would still need valid domain account credentials for that.

The risk for accessing the "data at rest" (i.e. data which is persistent even when the operating system is not running) can be alleviated by using encryption mechanisms which are tied to user input or removable keys (like smartcards) - for example with EFS.

1
  • 1
    You could also enable BitLocker on Vista and above to provide full disk encryption.
    – Nasko
    Jan 26 '12 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.