I am a vendor providing instructions to my users to cover of the situation where they want to create users on a windows server simply for the purpose of authentication.

Note: Active Directory is not involved or available.

These user should not have any other privilege, no interactive or network access to that server.

These users are created using the follow CMD script.

@echo off

echo Create group dbFrontUsers.
net localgroup dbFrontUsers /ADD

for /F "tokens=*" %%A in (UserList.txt) do (
  echo Create user '%%A'
  net user %%A changeM3! /add /comment:"10.5.2011" /fullname:"dbFront User %%A"
  net localgroup "dbFrontUsers" %%A /add
  ntrights -u %%A +r SeDenyNetworkLogonRight
  ntrights -u %%A +r SeDenyInteractiveLogonRight
  ntrights -u %%A +r SeBatchLogonRight
  ntrights -u %%A -r SeDenyBatchLogonRight
  ntrights -u %%A +r SeDenyServiceLogonRight
  ntrights -u %%A +r SeDenyRemoteInteractiveLogonRight

Where UserList.txt is a text file containing a simple list of valid usernames. And ntrights is a resourcekit tool for setting individual user rights.

My application is then set to validate all login requests by quering the server using the LoginType of Batch.

My question is: Do these users have unexpected privileges that could be abused externally or does this in some way compromise the hosting server?

To up the ante, some of my clients might intentionally do this on a Web Server.

  • These accounts do not introduce a direct vulnerability, but it might be possible for an attacker that has already partially compromised the system to use one of these accounts to escape from a sandbox. On the other hand, I think something very similar to this is how IIS authentication normally works - can someone with IIS experience comment on this? Jun 19 '18 at 21:53
  • PS1: You should probably be setting the rights on the group, rather than on each individual user, though if there are only a few users it won't matter. PS2: it might make things a little safer if the accounts were removed from Users and put in Guests, but unfortunately as those are primary groups I don't think you can do it from the command line. Jun 19 '18 at 21:57
  • @HarryJohnston, interesting idea about using groups. But I don't believe you can revoke rights via group membership?
    – AnthonyVO
    Jun 20 '18 at 4:00
  • No, you can't, but the only right you're revoking is SeDenyBatchLogonRight, and that step is redundant - or ought to be, at any rate. (I suppose in theory some other piece of software might be adding SeDenyBatchLogonRight on every newly created account, but that would be very strange.) Jun 20 '18 at 4:12
  • @HarryJohnston, if you create an answer summarizing your comments then I will give it to you. Thanks for you input.
    – AnthonyVO
    Jun 29 '18 at 4:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.