8

There are a number of special groups in Windows. Included among these are Authenticated Users, Interactive Users, Everyone, etc. These days, Everyone and Authenticated Users are effectively equivalent for most purposes, but if you had a pre-2003 domain level domain that would not be true. In any event, there is no way to observe the membership of these ...


5

I believe you've answered your question yourself correctly. Users and Guest accounts should not have the "Allow log on locally" rights on servers, only Administrators (and Backup Operators if necessary). Here is a MS KBA in which security countermeasures are described: https://technet.microsoft.com/en-us/library/dn221980.aspx Quote: "For domain ...


4

The nobody user is intended to be exactly that. A generic user account that doesn't belong to anyone and isn't used to run any services. As such, having a file owned by nobody:nobody is a way to make sure that only root has access but is not owned by root. My rule of thumb would be to create a service account to run your service. That way you have things ...


3

You'll need to update your Group Policy administrative templates (the best way to maintain this is to have a centralized ADMX template store on your DCs). Download the most up to date templates from here: https://www.microsoft.com/en-us/download/details.aspx?id=48257 The installer will just create a file structure of the current ADMX templates for windows -...


2

It's most likely connecting as a Media Device or Camera. There's a seperate GPO for each type of removable media. Perhaps this particular policy only enforces against flash drives. This is quite common on androids.. I can switch my device to be a Camera and bypass our GPO for blocking removable devices.


2

Authenticated users means exactly that - any and all users which have authenticated to the system. That would be any user that is a member of any group on your local system. Since Mike is a member of users he is inherently an authenticated user. In a domain environment this would be any user that is a member of any group on the domain.


2

You could turn your python scripts into windows executables using py2exe. That way it would be treated the same way you restrict other system binary. Be aware that it is possible to reverse-engineer by "uncompiling" it, showing the script functions and all. But as your question in only about enforcing execution authorization, i think that it will fulfill ...


2

In order to understand why they are doing this, it is best to go into the manager's shoes. I would disable everything except for the programs and utilities that the students etc. need, no more, no less. Fewer people know how to use taskill than those that know how to use taskmanager. Otherwise, it doesn't.


2

From the Microsoft perspective, I can tell you that this is something that the team responsible for publishing the security configuration baselines has changed position on over the years. In the past, they use to publish baselines with the recommended values specifically set, even if they were already the default. However, they no longer do that. Now, for ...


2

The ESAE (Red) Forest is now the goto recommendation for securing Active Directory. https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/securing-privileged-access-reference-material Without knowing the intricacies of your network, its hard to say for sure, but Domain Admins do not require network access to Domain ...


2

Generally, using an application whitelist will not only restrict what apps the user can directly launch, but also what apps the whitelisted apps can launch (after all, explorer.exe - the Windows graphical shell, which hosts the desktop, Start menu, taskbar, file browser, and so on - is itself just a process that launches other processes when told to do so). ...


1

For cases where the user is local admin, you are correct. There are numerous ways that the user could prevent execution in that case, even without blocking group policy stuff from taking effect generally. If you only need the program to run once, you can simply run it before handing it over to the employees / users, but if they have local admin they can ...


1

Here are some introductions to the PowerShell Script Block Logging and the PowerShell Transcription capabilities in WMF5 for Windows 7 (and later) -- https://adsecurity.org/?p=2277 You'll notice that instead of Local Policy it's network GPO available under: Windows Components -> Administrative Templates -> Windows PowerShell This Group Policy setting ...


1

Back in the 90s on my school's Netware network, you could use the task manager to avoid system policy restrictions. The exact details are fuzzy, but it went something like C+A+D at the Netware login screen to bring up task list; using run new task to spawn explorer.exe; then logging in. Explorer was already running, so system policies didn't get applied. ...


1

Whether or not this is standard is going to depend on your specific industry. Not knowing anything about yours or the nature of your projects, I can say this is a standard practice for data under legal hold, where a company is anticipating litigation and don't want to be accused of destroying evidence. Or the company wants to be able to demonstrate prior ...


1

Windows Group Policies control many different aspects of a running machine. I'm not sure there could be a single way to test the breadth of what a policy could cover. My approach is to define a test for each policy component (that can be tested) and use whatever tool is appropriate to execute that test. Sometimes that tool can be a script (Powershell, ...


1

How about the use of PyPy with its sandboxing mode? I'm afraid I'm not that familiar so I'm uncertain that it would be fully secure but certainly worth a look. As far as I can see, your only options are: PyPy sandboxing A Python to executable compiler Giving users a Virtual Machine which allows Python Using a PC sandboxing solution to isolate Python and ...


1

From wikipedia: In many Unix variants, "nobody" is the conventional name of a user account which owns no files, is in no privileged groups, and has no abilities except those which every other user has. adm: Group adm is used for system monitoring tasks. Members of this group can read many log files in /var/log, and can use xconsole. Historically, /...


Only top voted, non community-wiki answers of a minimum length are eligible