0

Looking at a lot of different security software on Windows, a lot of them rely on some settings on the computer which can probably be overridden by a local administrator.

For eg. some DLP software does some settings which prevents a user from using a USB drive. However, I think a local admin can always override this? A whitelisting product depends on a whitelist which is signed by a trusted source. However, the product's truststore is probably stored somewhere locally, so you can probably add a trust certificate and add a list signed by your own cert.

So the question here is - these products can prevent accidental misuse - but can they really protect a malicious local admin? Are there any settings which can be set at a domain level on Windows which restrict permissions on a local admin and make it a little more difficult?

  • if you add a domain, being local admin doesn't give you any rights in the domain. – cengizUzun Feb 17 '14 at 8:45
  • @cengizUzun - I am asking about permission restriction for a local admin on local machine. – user93353 Feb 17 '14 at 9:22
  • yeah, i meant, you can restrict all rights in the domain and give the permissions you wish – cengizUzun Feb 17 '14 at 11:18
  • @cengizUzun - I don't care about domain rights. I am asking if local permissions can be restricted for local admin – user93353 Feb 17 '14 at 11:22
1

Quite a lot of enterprise software tries to do this. For example, firewall or VPN software can have it's configuration locked by a central admin, and a local administrator cannot modify the settings through the GUI.

However, this does not stop a determined attacker with local admin access: they can still edit the registry or config files directly. I never liked this approach, but in a practical working environment, a lot of users do need admin rights, or you interfere with them doing their work.

One interesting variation on this approach is to heavily restrict the host OS, and not give out admin rights at all. But power users can run a guest OS inside a virtual machine, and they are allow full rights on this. I've not seen this implemented in a commercial environment, but I think the idea has merit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.