How can I disable the command line net command in windows server 2003? It would probably be good to do so for security purposes.
-
2Can you describe the security purpose as an example? (Concern: is there actually a security issue with NET, or is the security issue something that preventing the use of NET masks, but does not address?)– TristanKMar 18, 2011 at 3:54
-
Just as a added layer of protection in case a hacker gets shell access, so that they can't make a account for themselves.– James TMar 18, 2011 at 15:48
-
2Only Administrators (and Power Users, which are generally recommended against due to privilege escalation possibilities) could do that legitimately - if a hacker has admin access to a box, it's already game over.– TristanKMar 18, 2011 at 22:12
-
@TristanK: +10 on your immediately prior comment if I could.– Evan AndersonMar 19, 2011 at 1:38
Add a comment
|
1 Answer
The best way to disable a command is with Software Restriction Policies which will allow you to use group policy to disable the ability of a command to run for users you choose the policy to apply to.
-
1Disallowing software with Software Restriction Policy isn't very effective. All an attacker needs to do is make a copy of the disallowed program, append a single byte to the end of the program, and the program will execute w/o issue. Software Restriction Policy is really only effective when it's run in the "Deny All, Allow Exceptions" mode. Mar 19, 2011 at 1:40
-