117

Removing the GUI is useful and recommended. It will remove unused components, a lot of libraries, and makes the install size smaller. How does this make it less vulnerable? Fewer components equal less attack surface. A vulnerability on a GUI component will not affect you. Attacks relying on GUI components won't work either. So, when designing a server, ...


42

Removing the GUI also has the side effect of making it a bit more "human safe" because put bluntly, it makes the OS more idiot proof. There are countless stories of small businesses having users reading mail and browsing the internet on the company DC. The user opens a bad attachment and suddenly everything is on fire. Simply removing the GUI from server ...


27

Local Admin access means that it is easier for the attacker to establish persistent control of the host, to install software and modify system settings, and to take actions like sniffing the network that may allow it to move laterally onto other systems. So, yes, it is a danger to the network, in that it provides the attacker with more stable access to a ...


26

In my experience allowing and disallowing local admin access is common, just as common as dirty workarounds for the latter. - So you should ask yourself: Which threat to your network is made worse by local admin rights? To which the answer shoud be: NONE - The access to resources in your network should be restricted on a per user basis, completely ...


11

Danger is a bit of a strong word. I would say that local admin access presents additional network risks over non-admin access. Admin access allows the user to run a packet sniffer in promiscuous mode. That can present additional risks if the network in question is vulnerable to MiTM attacks, or other unencrypted, sensitive information goes across the ...


8

The problem you actually have is competent IT are attempting to enforce a boneheaded rule. You really only have one choice, give developers effective admin access. I keep seeing the same advice being repeated over and over again, that boils down to a second machine that the developer has admin but no internet. If you want to have swiss-cheese security that'...


7

It is far more danger than most people guess. When we debated how much someone could do from Local Admin (local account, not domain account) on one domain-joined machine, I said "Would you like to find out?" Nobody did. Turned out they wanted to debate the theory but not put it to the test. I argued on the other question what are you defending against. Well ...


7

I worked for some time for a company that really believes in security (or so they think). Every once in a while they would organize a social event, like playing bowling. Joining was free, but you had to add your name to a list in an Excel file, placed in a shared folder. That folder was dedicated to social events, nothing else. So, you want to play bowling?...


4

Short answer: Yes, it is common to have local admin access to selected groups, such as developers or IT admins. Basically, people whose day job is a lot easier with admin access while the usual office worker would need it at most once a month and typically much less than that. Long answer: It depends... For the general user population, you don't need to ...


4

Yes, it's dangerous. In 2014 I had a case which went like this: Developer with local admin rights takes ownership of utilman.exe, which is an ease-of-access application Replace utilman.exe by cmd.exe (which is also signed by Microsoft, so a signature check does not reveal it) Restart the PC and click the accessibility icon Voilà, you have a console with ...


3

As Chris already mentioned, an exploit could be run against the RDP server, or another gained access via another service (Telnet, SSH, Apache Server, etc...). Whether this was via a zero-day exploit or a brute force attack, is another matter. Two exploits come to mind though, CVE-2008-4250 and CVE-2012-0002. However, without logs, I cannot know for certain. ...


3

Admin access means you can run certain privilege-requiring tools. Packet sniffers are one mentioned by other. Another example is an ARP-spoofer/poisoner for MitM attacks, or an mDNS/NBT-NS impersonator(e.g. Responder). Generally any tool which requires low-level network access, or the ability to open certain protected ports is more likely to require admin ...


3

Segregate Your Networks You should have relatively isolated environments for development, testing, production, and business. This allows your devs to have privileges where they need them. Proper segregation prevents unauthorized changes, restricts the spread of malware, and impedes the exfiltration of data. What Happens Where? Development The ...


2

It is only typical to have local admin access denied to devs in companies where either the devs are so useless/malicious they abuse those privileges, or where the "IT and Security" department is run by clueless knee-jerk idiots who view everyone not in their inner circle as an obvious security threat out to make them look bad. Considering your "IT and ...


2

As Serge's answer mentions, you may want to consider some contractual controls for this situation, in addition to your technical approach. I am going to assume for this discussion that this action has already been approved through your company's Compliance Program and complies with your Policies. Don't grant low-level systems access to a third-party like ...


2

No, this is not normal behavior. Most likely, the server has been compromised, and it has a backdoor installed that forwards the connection to RDP server. Probably a reverse tunnel, given that the RDP port itself is exposed to the internet and forwarding from another port wouldn't be that useful (it would just conceal the connection a bit). I would try to ...


1

Highest chances are they either found a valid exploit on the RDP version on this system and they gained access without credentials, or they found an exploit at another exposed service running in the same machine, got administrative access through it and launched an RDP connection to their new user. Scenario no.2 (gaining access from another service) could ...


1

AskDS team (Microsoft) have a series of posts that covers 2-tier PKI (what you are looking for) deployment with ADCS: Part I Design and Planning Part II Implementation Phases and Certificate Authority Installation Part III Certificate Templates Part IV Configuring SSL for Web Enrollment and Enabling Key Archival Part V Disaster Recovery what you can safely ...


1

While it is a bad idea to still keep the server running such old and unsupported systems are actually often found in industrial environments where they are used to run some software only supported on such older OS or which is tied to specific hardware. The way to limit the risk in such cases is to minimize the attack surface as much as possible. This means ...


1

It's not a DDoS. It's a windows server 2008 r2 with latest updates, and the websites have an A rating on ssllabs. That's what the source of the traffic is. The SSL Labs scanner will make a large number of SSL/TLS handshakes in order to test for support of various ciphers and features.


1

Your guess about certutil is correct and certutil -repairstore should do the trick. The only requirement is that HSM middleware must be installed on a target machine and target machine can access keys on HSM. Alternatively, you may try to use CertSetCertificateContextProperty CryptoAPI function and set CERT_KEY_PROV_INFO_PROP_ID property that will include ...


1

In IIS Manager, (if the sub-feature has been installed) there is a node for IP Address and Domain Restrictions which will allow you to determine which IP addresses you want to allow and/or deny either for a specific website or for all websites on the server. If you don't see this node, it is because the sub-feature has not been installed. In that case, ...


1

Starting with Windows 10, the Windows Defender Security Center will track for the presence and configuration of antivirus, firewall, account protection, app/browser controls, and device security.


1

The file you're looking for, %systemroot%\System32\sru\SRUDB.dat, is managed by the Diagnostic Policy Service. If the file isn't present, you may find that service isn't running. Take a look in services.msc and check to see if the service is running. Diagnostic Policy Service should be able to create the missing file when run.


1

From here: Trojan.Naid is a Trojan horse that opens a back door on the compromised computer. When the Trojan is executed, it creates the following files: %UserProfile%\AppMgmt.dll %Windir%\Temp\uid.ax The Trojan creates the following registry entries: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\AppMgmt\"Start" = "2" ...


1

This is a completely unreasonable request. Why does it need to be unmonitored(TeamViewer is not 'unattended')? 'Unattended' means automated e.g. unattended imaging/zti... they're just asking you not to participate. If it's some proprietary change, that's better dealt with by an NDA; after all, you could reverse-engineer any changes afterwards, like you're ...


1

No if you patch Winzip frequently. Yes if you don't patch it. This answer applies to all software on a server not just Winzip. Only put software on a server that is required in order to reduce risk and attack surface.


1

Powershell transcript logging records every single thing from each powershell session. This feature is available since PS version 5 and above. Please refer: here


1

Dsquery is just a tool to query the active directory, it by itself isn't malicious or leaking personal info. What happens is that this tool queries the active directory, which is Microsoft's database to manage windows devices and users in a centralized location. Your IT administrator configured a naming policy, if that naming policy contains private ...


Only top voted, non community-wiki answers of a minimum length are eligible