Well, yeah. PAM allows root to do whatever it wants, including assume the identity of other users.
If an ipa admin happens to be logged into the test vm then the
developer can sudo su to the ipa admin and then log into the ipa
servers with kerberos delegation.
Don't do that. Use a separate admin account for identity services, and forbid it from ...
Your theory is correct. This behaviour can be changed via a registry setting.
find or create the DWORD value LocalAccountTokenFilterPolicy and set it to 1. You may then need to reboot.
This will allow remote connections to have unrestricted administrator access.
waddayaknow! I found the answer myself: it's indeed to do with policykit. On my Kubuntu 18.10 I had to change the following file (/etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf) to have it say:
instead of the default:
under the [Configuration] section.
Please note ...
don't give users admin rights, then, if you want to lock down what runs on windows, configure AppLocker. without GPMC use secpol.msc see https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview
This is caused by a known issue in the January 2019 cumulative update:
Local users who are part of the local “Administrators“ group may not be able to remotely access shares on Windows Server 2008 R2 and Windows 7 machines after installing the January 8th, 2019 security updates. This does not affect domain accounts in the local "Administrators" group.
If you are using kerberos authentication, adding another DNS record pointed to a file server will not work. The correct why to add another name is the following command:
NETDOM COMPUTERNAME foo /ADD bar.example.com
Two recent Windows Updates (KB 4480970 and KB 4480960) broke the ability for administrators to access SMB2 shares on several OS versions, including Windows Server 2008 R2. That fits your description quite well.
See: KB 4480970 and or KB 4480960 breaks SMB2 connections to Windows 7 shares and https://www.theregister.co.uk/2019/01/09/windows_7_network_broken/...
An application that is using VDS must run under the Backup Operator or
Administrators group account. Without the appropriate privilege, an
application can create a service loader object, but the object will
not load VDS. Instead, it returns an error indicating that access to
VDS is denied.
So it appears that the application is ...
The UAC prompt is an all-or-nothing proposition, you either allow the program administrator access or don't run it at all.
That doesn't necessarily mean that you can't achieve your goals in other ways. For example, if you want to give a user access to the address space of a particular process, you can change the permissions on that process. Similarly with ...
There's a couple things here. When you selected 'run when not logged in' did it ask for your password and save? If there was no error, then it should still be able to run. The next question is what is the trigger? Is a time, an eventlog entry, at logon? If there's no trigger it will not run unless somebody executes it manually. Third if somebody 'removes ...