Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question is related to my previous question on Log on As a Service;

I have found out that our windows hosting provider's Active Directory domain "Domain Users" group is part of our servers' "Users" group, and as I understand it that means all users of the domain are also users of the server.

In my case this is not an immediate concern, because our servers are behind a firewall, so other domain users (except hosting provider's admin staff who get through) would not be able to reach the servers' network.

I am trying to figure out how much of a potential risk this represents, however. If our firewall were to drop out of the picture (suddenly allow any traffic through), what could accounts in the "Users" group actually do?

I've tried the following:

  • File access via UNC shares: only explicitly exposed shares would be a problem, because C$ etc is Admins-only
  • psexec for remotely running commands: only seems to work for admins
  • RDP/Terminal Services: (by default) Admins only
  • pslist: "Users" don't have access to "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Perflib" so no-go

What am I missing? Is there really nothing that a member of the "Users" group can do from the network on a standard windows machine without explicit UNC shares? I feel like I must be missing something, because they do have "Allow log on locally"...

share|improve this question
    
most hackers would not use the local users account for hacking purposes it potentially lights up the logs to much. They'd just hack the publically available ports. –  tony roth Jun 23 '10 at 22:27

1 Answer 1

So far I've found one thing only: If you have IIS installed on the server, and you require Authentication (either on an FTP site or Website), then this situation will allow all domain users to log in as authenticated users, which may not be (in my case definitely is not) what is intended.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.