I am a vendor providing instructions to my users to cover of the situation where they want to create users on a windows server simply for the purpose of authentication.
Note: Active Directory is not involved or available.
These user should not have any other privilege, no interactive or network access to that server.
These users are created using the follow CMD script.
@echo off echo Create group dbFrontUsers. net localgroup dbFrontUsers /ADD for /F "tokens=*" %%A in (UserList.txt) do ( echo Create user '%%A' net user %%A changeM3! /add /comment:"10.5.2011" /fullname:"dbFront User %%A" net localgroup "dbFrontUsers" %%A /add ntrights -u %%A +r SeDenyNetworkLogonRight ntrights -u %%A +r SeDenyInteractiveLogonRight ntrights -u %%A +r SeBatchLogonRight ntrights -u %%A -r SeDenyBatchLogonRight ntrights -u %%A +r SeDenyServiceLogonRight ntrights -u %%A +r SeDenyRemoteInteractiveLogonRight )
Where UserList.txt is a text file containing a simple list of valid usernames. And ntrights is a resourcekit tool for setting individual user rights.
My application is then set to validate all login requests by quering the server using the LoginType of Batch.
My question is: Do these users have unexpected privileges that could be abused externally or does this in some way compromise the hosting server?
To up the ante, some of my clients might intentionally do this on a Web Server.