What can “Users” group do by default from the network without RDP or physical access?

Question

This question is related to my previous question on Log on As a Service;

I have found out that our windows hosting provider's Active Directory domain "Domain Users" group is part of our servers' "Users" group, and as I understand it that means all users of the domain are also users of the server.

In my case this is not an immediate concern, because our servers are behind a firewall, so other domain users (except hosting provider's admin staff who get through) would not be able to reach the servers' network.

I am trying to figure out how much of a potential risk this represents, however. If our firewall were to drop out of the picture (suddenly allow any traffic through), what could accounts in the "Users" group actually do?

I've tried the following:

• File access via UNC shares: only explicitly exposed shares would be a problem, because C$ etc is Admins-only
• psexec for remotely running commands: only seems to work for admins
• RDP/Terminal Services: (by default) Admins only
• pslist: "Users" don't have access to "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Perflib" so no-go

What am I missing? Is there really nothing that a member of the "Users" group can do from the network on a standard windows machine without explicit UNC shares? I feel like I must be missing something, because they do have "Allow log on locally"...

Answer 1

So far I've found one thing only: If you have IIS installed on the server, and you require Authentication (either on an FTP site or Website), then this situation will allow all domain users to log in as authenticated users, which may not be (in my case definitely is not) what is intended.