Can you get the administrator password through command prompt?

[Jayce]

Just out of curiosity... because a student got busted earlier today for being logged on to a computer as administrator. By sheer luck, a tech person walked in, spotted him, and booted him off. He told the principal he got the password through command prompt.

Now, I'm curious... is that possible? Or was that a white faced lie?

 

[office politics]

could be an privledge escalation attack.

schedule a task to start cmd.

the cmd windows starts with local system privledge.

user resets admin password.



SecurityReason - Windows XP Task Scheduler Local Privilege Escalation (Advisory)

 

[Jayce]

Found it.

Start - Run - CMD -
net user <username> <password>

It resets the local administrator password.

The ironic part is, student accounts are local administrators cause programs like photoshop require admin rights. So we grant local admin rights but not network admin rights (obviously we wouldn't ever give a student network admin rights though). So all this student did was reset the administrator password to the local computer which already had the same priviledges he had anyway. What a way to lose your computer priviledges for the rest of your high school career... by resetting a password on an account that already has the same permissions you do.

LOL?

 

[Luke]

i know it's possible, but most large computer networks have the CP disabled, and you need it to reset the password. But it is possible with the cp.

 

[Jayce]

To my knowledge, "cmd" is blockable by group policies.

"command" is not.

So either way, we're stuck... unless we can figure something else out?

 

[Luke]

^all i know is with the command prompt you can do it. Aren't the cmd and "command" the same thing anyway? I don't know much about that aspect of computer though.

 

[Jayce]

Yeah, I believe cmd and command are the same thing, but different commands to get the same result...

I'm not positive, it's just what I've heard when I was reading about it.

 

[Jayce]

Question - Where is the "command" file at on a Windows 2k Pro/XP Pro system?

Reason is, "cmd" can be blocked by group policies. "command" cannot. An idea was brought up about renaming "command" on the systems we deploy to something that students won't think about. But, we gotta find the file to do that. Where could I find it?

 

[Kharn]

Jayce have you thought of using steady state? I know it's a little bit more customisable than group policy's, you can as far as I know say yes user can do this this and this but you cant do that that an that. So you can give them local admin rights for the programs that need it, but the moment there session times out OR they log out the computer is returned to the state that you can specify.

Edit:
Here is some linkadge for you -
http://www.microsoft.com/windows/products/winfamily/sharedaccess/default.mspx
Protect Your Computer: Windows SteadyState - Microsoft Security

 

[Jayce]

Like deep freeze?

We had deep freeze on those computers before, but there were several problems.

For one, the hard drives were burning out left and right. With the amount of students that use them I guess the hard drives reading/writing the way they were was just too much strain. They're not under warranty anymore and, as I said, we pretty much replaced the entire lab's hard drives by now. Once we took deep freeze off, things went smoother and the replacements were cut back severely.

The second thing is, updates. The only way we can get updates to those computers is by disabling deep freeze and allowing the updates to come through. Then, afterwards, deep freeze is re-enabled.

I'm not sure what that application can offer that deep freeze doesn't already do, but we have licensing for deep freeze... so... yeah...