While installing a new XP machine that had not been connected to the domain I was browsing to a UNC path and was not prompted for authentication. I then went to the different mapped drives and found that I had full access to all files and folders on the network.
I was logged into the machine as a local administrator account that had the same name as a domain administrator. Could that have been the reason that I had unrestricted access using the local account on a machine that was not joined to the domain? If so what steps should I take to secure this.
In addition to this we have recently experienced the cryptolocker malware and it was able to encrypt files that the host user had no access too, so I suspect that the vulnerability mentioned above is related.