up vote 2 down vote favorite
share [g+] share [fb]

We have some off-the-shelf OCR software that we'll be using to automate processing of certain customer forms that come to us via fax at all hours of the day. The OCR process needs to run 24 x 7, but the software we have doesn't have an option to install as a service, and as a result a user needs to be logged in to "watch" a folder or queue for items to process.

I've always been pretty religious about logging out of our Windows servers when not directly administering them, but running the OCR software's folder watch feature will require that I instead leave the server it's installed on logged in and locked at all times. I'm aware from a security standpoint that this will disclose the account name to anyone who has physical access to the server (as it fills in the logged in user's name when you go to unlock), and I'll take some commensurate steps to further secure physical access, but I'm wondering if anyone has any other words of caution or wisdom about the risks (specifically w/r/t security, as performance isn't likely to be an issue in this instance) of running a Windows Server (2003 in this case) always logged in on our LAN.

link|improve this question
95% accept rate
2  
Is it possible to run it on a workstation instead? – Driftpeasant Dec 9 '11 at 21:58
@Driftpeasant, Good question. Since it needs to run reliably 24x7 I'd rather have it on a server, and I can control physical access better that way as well. But if there are reasons I shouldn't do this I'm willing to reconsider. – nedm Dec 9 '11 at 22:02
4  
Throw the software into a virtual machine! Then it can run in the background.... logged in... free from users' poking & proding. – TheCompWiz Dec 9 '11 at 22:03
Honestly, it sounds like terra-bad software if it requires a user to be logged in. – TheCompWiz Dec 9 '11 at 22:04
note that it also discloses the login name to anyone with remote acess – Jim B Dec 9 '11 at 22:08
show 6 more comments
feedback

3 Answers

up vote 1 down vote accepted

Throw it in a VM. That way the process can run in the background, and users' fingers won't be able to fiddle with bits they shouldn't.

link|improve this answer
feedback
up vote 1 down vote

You can avoid showing the login name of the locked user by setting Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Display user information when the session is locked. The vulnerability here is that showing the names allows people either looking at the console or RDPing to the console to see usernames. You shold also restrict remote access to only those users allowed to login to the server.

link|improve this answer
That's great, we've set it in GP to not show on login, but I wasn't aware you could do so for unlocking a session too! – nedm Dec 9 '11 at 22:07
I have to say - unless the users are local admins, not showing who had a locked session is just asking for a ticket to IT every time the machine is locked and User X can't unlock it. – Driftpeasant Dec 9 '11 at 22:13
@Driftpeasant - don't think it would be a problem if set locally in a DC vs via a GPO for user workstations, say. – nedm Dec 9 '11 at 22:16
@Driftpeasant user x can unlock it but user y won't be happy about it. – Jim B Dec 9 '11 at 22:33
feedback
up vote 0 down vote

Everybody who has direct physical access to a Server is able to compromise it. And in this case he doesn't even have to know any user name at all.

So locking a Server/PC is as secure as leaving it "logged-off".

link|improve this answer
What does having physical access have to do with showing login names? – Jim B Dec 9 '11 at 22:07
@JimB He mentioned that in the second paragraph. He is concerned that someone could gain more information to "break in" while having physical access. But with physical access this would be the minor problem. – mailq Dec 9 '11 at 22:10
I just attempt, whenever it's reasonable, to minimize exposure of account names that have any rights on a Server -- for the same reason that it's best practice to change the default admin user name. Not a silver bullet by itself by any means and not an attempt to rely on security-by-obscurity, but rather one small layer of defense-in-depth. :) – nedm Dec 9 '11 at 22:29
In this case you should also plug-off the monitor. Just another layer... – mailq Dec 9 '11 at 22:56
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.