Many managed(e.g. school, government) computers disable windows task manager. In the case of school computers, the computer often allows arbitrary programs to be run, can allow batch files, and sometimes comes equipped with a language like java.
Does disabling task manager add any security if one can use taskkill or tasklist to list or kill processess?
-
5Poor management practices, incompetence, checking a list box handed them by a "security expert". How would we know why they do something ineffective?– John DetersOct 7, 2016 at 1:22
-
Just checking if I missed anything.– StoudOct 7, 2016 at 1:27
-
1) Reducing attack surface. 2) Only things that are explicitly permitted are allowed and they have no reason to explicitly permit Task Manager. 3) The implementation of 2 in Windows is very incomplete.– user253751Oct 7, 2016 at 5:24
-
You mean no reason other than allowing users to terminate hung processes, instead of just going for the power switch?– Craig TullisOct 8, 2016 at 4:51
Add a comment
|
3 Answers
In order to understand why they are doing this, it is best to go into the manager's shoes.
I would disable everything except for the programs and utilities that the students etc. need, no more, no less.
Fewer people know how to use taskill than those that know how to use taskmanager. Otherwise, it doesn't.
-
My question to this is: why does it matter if people who don't know what they are doing open task manager?– StoudOct 7, 2016 at 2:05
-
-
Ah, sorry. Well, if you don't know what you are doing, and you open taskmgr by accident, what is the worst that can happen? Hopefully, if your group policy and stuff is set up correctly, the most they can do is close a program that is not responding, maybe kill some windows GUI (like lose the start bar). Security programs should be running as admin anyways. Blocking taskmgr shouldn't be the only countermeasure, but it might not hurt just in case.– dGRAMOPOct 7, 2016 at 2:10
Back in the 90s on my school's Netware network, you could use the task manager to avoid system policy restrictions. The exact details are fuzzy, but it went something like C+A+D at the Netware login screen to bring up task list; using run new task to spawn explorer.exe; then logging in. Explorer was already running, so system policies didn't get applied.
Once they figured that out, they'd disable the task manager to prevent students from doing that - so at the very least it did something once upon a time.
In addition to what fwaggle said (you can spawn new processes), and ThePROgrammer's very correct answer: depending if and if yes, then what kind of surveillance / management software im deployed, this software might be vulnerable to be "killed" by terminating it's process in the Task Manager.
I personally used this to some extent at school. Task Manager was disabled very quickly..
