From: "Excell Warez" <ahern.ham...@xtra.co.nz>
Subject: Q: Is it possible for ADMIN to log onto my PC via network and
view all my private files?
Date: 1998/06/04
Message-ID: <6l3i3k$bf1$1@newsource.ihug.co.nz>#1/1
X-Deja-AN: 359124791
X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4
Organization: The Internet Group Ltd
Mime-Version: 1.0
Newsgroups: alt.2600.hackerz,alt.hackers.malicious,
comp.os.ms-windows.nt.admin.networking,comp.os.ms-windows.nt.admin.security,
comp.os.ms-windows.nt.misc,microsoft.public.windowsnt.setup
Hello,
I'm new to WinNT and I have a question ref. security:
I have a NT4-Workstation in a LAN.
1)=20
Is it possible, that the Administrator logs on to my PC via the
Network? Can he see all my private files on my local disk?
Just with shared defaults C$? etc.?
2)
If so, can I check if there was a logon from the Administrator?
Is there a log-file?
I'm looking forward to your answers per EMAIL: =
mailto:ahern.ham...@xtra.co.nz
Regards,
Hamish Ahern
From: "Nick Brown" <Nick-dot-Brown@coe-dot-fr>
Subject: Re: Is it possible for ADMIN to log onto my PC via network and
view all my private files?
Date: 1998/06/03
Message-ID: <01bd8f12$d9202df0$ec2b010a@p970361>#1/1
X-Deja-AN: 359200327
References: <6l3i3k$bf1$1@newsource.ihug.co.nz>
Organization: a Digital Internet AlphaServer Site
Newsgroups: alt.2600.hackerz,alt.hackers.malicious,
comp.os.ms-windows.nt.admin.networking,comp.os.ms-windows.nt.admin.security,
comp.os.ms-windows.nt.misc,microsoft.public.windowsnt.setup
1) Yes
2) You have to set up the Security log, but even then, you may not get what
you want - the domain admin's logon is noted at the BDC, not the machine
where the connection is made.
Suggest you pur your unauthorised stuff into password protected ZIPs. Or
set the NTFS permissions so the administrator has no access, unless he
becomes owner, in which case you'll know.
From: jer...@netcom.com (Jeremy Allison)
Subject: Re: Is it possible for ADMIN to log onto my PC via network and
view all my private files?
Date: 1998/06/04
Message-ID: <jeremyEu1nsC.2DI@netcom.com>#1/1
X-Deja-AN: 359596579
Sender: jer...@netcom13.netcom.com
References: <6l3i3k$bf1$1@newsource.ihug.co.nz>
<01bd8f12$d9202df0$ec2b010a@p970361> <uiumhp6ev.fsf@xxx.yyy.zzz>
Organization: Netcom On-Line Services
Newsgroups: comp.os.ms-windows.nt.admin.networking,
comp.os.ms-windows.nt.admin.security,comp.os.ms-windows.nt.misc,
microsoft.public.windowsnt.setup
>"Nick Brown" <Nick-dot-Brown@coe-dot-fr> writes:
>
> Or set the NTFS permissions so the administrator has no access, unless he
> becomes owner, in which case you'll know.
No you wouldn't. The administrator would just take ownership
of all your files, read them, and then set the ownership back
to you.
This is easy on NT (despite the fact that Microsoft's documentation
*still* says it's impossible. A lie repeated enough becomes the
truth.....).
Remember, on NT, Admin == root on UNIX.
Jeremy Allison.
Samba Team.
From: gar...@ibis.demon.co.uk (Gareth Jones)
Subject: Re: Is it possible for ADMIN to log onto my PC via network and
view all my private files?
Date: 1998/06/04
Message-ID: <35790ddc.1020827@news.demon.co.uk>#1/1
X-Deja-AN: 359609881
Content-Transfer-Encoding: 7bit
X-NNTP-Posting-Host: ibis.demon.co.uk:158.152.10.10
References: <6l3i3k$bf1$1@newsource.ihug.co.nz>
<01bd8f12$d9202df0$ec2b010a@p970361> <uiumhp6ev.fsf@xxx.yyy.zzz>
<jeremyEu1nsC.2DI@netcom.com>
Content-Type: text/plain; charset=us-ascii
X-Complaints-To: abuse@demon.net
X-Trace: news.demon.co.uk 896996101 nnrp-02:16508 NO-IDENT ibis.demon.co.uk:158.152.10.10
MIME-Version: 1.0
Newsgroups: comp.os.ms-windows.nt.admin.networking,
comp.os.ms-windows.nt.admin.security,comp.os.ms-windows.nt.misc,
microsoft.public.windowsnt.setup
jer...@netcom.com (Jeremy Allison) wrote:
>>"Nick Brown" <Nick-dot-Brown@coe-dot-fr> writes:
>>
>> Or set the NTFS permissions so the administrator has no access, unless he
>> becomes owner, in which case you'll know.
>
>No you wouldn't. The administrator would just take ownership
>of all your files, read them, and then set the ownership back
>to you.
How do you set the ownership back to the user?
Gareth
From: "Joe Miller" <a...@anon.anon>
Subject: Re: Is it possible for ADMIN to log onto my PC via network and
view all my private files?
Date: 1998/06/04
Message-ID: <6l74so$bps$1@news.onramp.net>#1/1
X-Deja-AN: 359621288
Content-Transfer-Encoding: 7bit
References: <6l3i3k$bf1$1@newsource.ihug.co.nz>
<01bd8f12$d9202df0$ec2b010a@p970361> <uiumhp6ev.fsf@xxx.yyy.zzz>
<jeremyEu1nsC.2DI@netcom.com> <35790ddc.1020827@news.demon.co.uk>
Content-Type: text/plain; charset="us-ascii"
X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3
Organization: OnRamp, http://www.onramp.net/
Mime-Version: 1.0
Newsgroups: comp.os.ms-windows.nt.admin.networking,
comp.os.ms-windows.nt.admin.security,comp.os.ms-windows.nt.misc,
microsoft.public.windowsnt.setup
You don't, you can only TAKE ownership. To set ownership back to the user
you would have to be logged in as the user and take ownership.
Gareth Jones wrote in message <35790ddc.1020...@news.demon.co.uk>...
>jer...@netcom.com (Jeremy Allison) wrote:
>
>>>"Nick Brown" <Nick-dot-Brown@coe-dot-fr> writes:
>>>
>>> Or set the NTFS permissions so the administrator has no access, unless
he
>>> becomes owner, in which case you'll know.
>>
>>No you wouldn't. The administrator would just take ownership
>>of all your files, read them, and then set the ownership back
>>to you.
>
>How do you set the ownership back to the user?
>
>Gareth
From: jer...@netcom.com (Jeremy Allison)
Subject: Re: Is it possible for ADMIN to log onto my PC via network and
view all my private files?
Date: 1998/06/05
Message-ID: <jeremyEu217v.58v@netcom.com>#1/1
X-Deja-AN: 359671433
Sender: jer...@netcom13.netcom.com
References: <6l3i3k$bf1$1@newsource.ihug.co.nz>
<01bd8f12$d9202df0$ec2b010a@p970361> <uiumhp6ev.fsf@xxx.yyy.zzz>
<jeremyEu1nsC.2DI@netcom.com> <35790ddc.1020827@news.demon.co.uk>
<6l74so$bps$1@news.onramp.net>
Organization: Netcom On-Line Services
Newsgroups: comp.os.ms-windows.nt.admin.networking,
comp.os.ms-windows.nt.admin.security,comp.os.ms-windows.nt.misc,
microsoft.public.windowsnt.setup
"Joe Miller" <a...@anon.anon> writes:
>You don't, you can only TAKE ownership. To set ownership back to the user
>you would have to be logged in as the user and take ownership.
Arrrgggghhhhh.
How many more times..... (I must admit this one is a *personal*
hate of mine, this piece of misinformation is like a zombie, I
kill it in one newsgroup and it pops up again in another - usually
this one :-).
One more time...
Administrator == root on UNIX.
They can take ownership of your files, read all the porn
GIFs you have, mail them to their friends, add incriminating
evidence (you get the idea :-) and then re-assign ownership
back to you (and even set the timestamp on the file) so you
*would never know*.
That's why they're the admin - they can do *anything* on
an NT box.
Read up on NT. Learn about the 'SE_RESTORE_NAME' privillage (ie. it
allows you to set a file owner, as you need to do when you're
restoring a file from backup tape).
If you *really* bug me I'll post approx 3000 lines of source
code that includes the a Win32 chown command, runnable by
the NT admin, that will change the ownership of a file
to *any* arbitrary user. I don't want to though, I've posted
it many times before (usually when someone on this group
pisses me off enough by parroting the Microsoft documentation
line of "can't be done, NT is secure, can't be done, NT is
secure....." etc.).
NT can be secure (when properly administered), and allowing the
admin user to change file ownership has *nothing* to do with
how secure an OS it is. It's more to do with lazyness in not
providing utilities with the OS that UNIX people take for
granted. Just making something harder to do, and claiming
in the doc's that it's impossible, does not make an OS
secure. Only the administrator can make an OS secure.
Do me a favour, look it up in DejaNews.
REMEMBER (for the last time).
ADMINISTRATOR ON NT IS ROOT !!!!!!!!!!!!!!!
Jeremy Allison.
From: Jason Boche <hulio...@mm.com>
Subject: Re: Is it possible for ADMIN to log onto my PC via network and
view all my private files?
Date: 1998/06/04
Message-ID: <357756FA.513E@mm.com>#1/1
X-Deja-AN: 359685054
Content-Transfer-Encoding: 7bit
References: <6l3i3k$bf1$1@newsource.ihug.co.nz>
<01bd8f12$d9202df0$ec2b010a@p970361> <uiumhp6ev.fsf@xxx.yyy.zzz>
<jeremyEu1nsC.2DI@netcom.com> <35790ddc.1020827@news.demon.co.uk>
<6l74so$bps$1@news.onramp.net> <jeremyEu217v.58v@netcom.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Organization: [poster's organization not specified]
Newsgroups: comp.os.ms-windows.nt.admin.networking,
comp.os.ms-windows.nt.admin.security,comp.os.ms-windows.nt.misc,
microsoft.public.windowsnt.setup
Replies inline....
Jeremy Allison wrote:
>
> "Joe Miller" <a...@anon.anon> writes:
>
> >You don't, you can only TAKE ownership. To set ownership back to the user
> >you would have to be logged in as the user and take ownership.
>
> Arrrgggghhhhh.
>
> How many more times..... (I must admit this one is a *personal*
> hate of mine, this piece of misinformation is like a zombie, I
> kill it in one newsgroup and it pops up again in another - usually
> this one :-).
Then why bother? Somewhere, somehow, most people are coming up with the
answer "cang grant ownership" as opposed to your Win32 chown program.
Where do you think we are getting these answers? We are giving answers
based on a stand-alone packaged product in an isolated environment.
> One more time...
>
> Administrator == root on UNIX.
We're talking about native Windows NT - I don't know how UNIX came into
this question.
> They can take ownership of your files, read all the porn
> GIFs you have, mail them to their friends, add incriminating
> evidence (you get the idea :-) and then re-assign ownership
> back to you (and even set the timestamp on the file) so you
> *would never know*.
These admins sound really professional, anyone you know?
> That's why they're the admin - they can do *anything* on
> an NT box.
Sounds like "they" have alot of free time on their hands; don't they
have some kind of productive project to be working on? Sounds like an
internal position that can be transititioned out of the company to
me....
> Read up on NT. Learn about the 'SE_RESTORE_NAME' privillage (ie. it
> allows you to set a file owner, as you need to do when you're
> restoring a file from backup tape).
I've read up on NT and done my homework thusfar.
> If you *really* bug me I'll post approx 3000 lines of source
> code that includes the a Win32 chown command, runnable by
> the NT admin, that will change the ownership of a file
> to *any* arbitrary user. I don't want to though, I've posted
> it many times before (usually when someone on this group
> pisses me off enough by parroting the Microsoft documentation
> line of "can't be done, NT is secure, can't be done, NT is
> secure....." etc.).
No thanks - I'm not a programmer and I wouldn't understand most of the
code anyway. How do people piss you off so easily? Do you get out
enough? I find it a pleasant experience to step away from the keyboard
every so often.
I doubt the original poster of this question actually had your 3000 line
code that runs the infamous Win32 chown command so basically we're
talking about a standard Windows NT install in which the answer is:
There is no way to "give" ownership to someone, only take.
If you would like to re-write Microsoft's OS, by all means, feel free to
- you should be working for Microsoft I would think, otherwise, don't
get so bent out of shape there Jeremy.
> NT can be secure (when properly administered), and allowing the
> admin user to change file ownership has *nothing* to do with
> how secure an OS it is.
I would sure hope ownership has EVERYTHING to do with security on a
LAN/WAN! I'm sure if Microsoft found it acceptable they would have
included the ability to grant ownership to other SIDs.
> It's more to do with lazyness in not
> providing utilities with the OS that UNIX people take for
> granted.
Ok.. now we're getting to the root of your anger... you don't like
Microsoft.
> Just making something harder to do, and claiming
> in the doc's that it's impossible, does not make an OS
> secure. Only the administrator can make an OS secure.
Nothing is impossible Jeremy, we all know that. No NOS is 100% secure
and I Microsoft never implies ANYWHERE that it is 100% secure - that
would be the kiss of death. Any hacker will define impossible as "It
just hasn't been done yet".
I'd rather work with and support an OS that I like and grow with it
rather than simply try to poke holes in it every chance I get - that's
too easy.
> Do me a favour, look it up in DejaNews.
I don't have time to chase every single "what if" and "hack" thread with
regards to Microsoft or any other enterprise wide NOS - I'll just take
your word for it.
> REMEMBER (for the last time).
>
> ADMINISTRATOR ON NT IS ROOT !!!!!!!!!!!!!!!
Why don't you write a book and have it published?
> Jeremy Allison.
Jas
--
--------------------------------------------------
Jason Glenn Boche, MCSE, A+ Certified
EMAIL: hulio...@mm.com
CORPORATE EMAIL: jason.g.bo...@norwest.com
WWW: http://www.mm.com/user/hulio496/
ICQ: 272710
From: jer...@netcom.com (Jeremy Allison)
Subject: Re: Is it possible for ADMIN to log onto my PC via network and
view all my private files?
Date: 1998/06/05
Message-ID: <jeremyEu38AF.Hw8@netcom.com>#1/1
X-Deja-AN: 359876549
Sender: jer...@netcom13.netcom.com
References: <6l3i3k$bf1$1@newsource.ihug.co.nz>
<01bd8f12$d9202df0$ec2b010a@p970361> <uiumhp6ev.fsf@xxx.yyy.zzz>
<jeremyEu1nsC.2DI@netcom.com> <35790ddc.1020827@news.demon.co.uk>
<6l74so$bps$1@news.onramp.net> <jeremyEu217v.58v@netcom.com> <357756FA.513E@mm.com>
Organization: Netcom On-Line Services
Newsgroups: comp.os.ms-windows.nt.admin.networking,
comp.os.ms-windows.nt.admin.security,comp.os.ms-windows.nt.misc,
microsoft.public.windowsnt.setup
Jason Boche <hulio...@mm.com> writes:
>Then why bother? Somewhere, somehow, most people are coming up with the
>answer "cang grant ownership" as opposed to your Win32 chown program.
>Where do you think we are getting these answers? We are giving answers
>based on a stand-alone packaged product in an isolated environment.
Because I hate ignorance. You are giving incorrect answers,
and just repeating what you have been taught by MS docs.
The docs are *wrong*, ok :-).
>We're talking about native Windows NT - I don't know how UNIX came into
>this question.
Well, Administrator on NT is a good analogy to root on UNIX,
many people have some experience with UNIX and understand
the concept of an all powerful super user, I hoped you were
one of them.
>These admins sound really professional, anyone you know?
No, thank goodness, I was pointing out the fallacy of
believing their files were completely private just
by setting NTFS ACLs.
>Sounds like "they" have alot of free time on their hands; don't they
>have some kind of productive project to be working on? Sounds like an
>internal position that can be transititioned out of the company to
>me....
Now you're just getting silly :-).
>I've read up on NT and done my homework thusfar.
Well obviously not enough. If you had, you'd have known
that the 'cannot set ownership of files' was incorrect.
>No thanks - I'm not a programmer and I wouldn't understand most of the
>code anyway. How do people piss you off so easily? Do you get out
>enough? I find it a pleasant experience to step away from the keyboard
>every so often.
Fair enough, I'm glad I don't have to. I'm not pissed off,
it's just that this misinformation never seems to die.
I'm sorry if it seemed that I was personally getting at
you, I wasn't. I was bugged by seeing this old chestnut
posted yet again.
>I doubt the original poster of this question actually had your 3000 line
>code that runs the infamous Win32 chown command so basically we're
>talking about a standard Windows NT install in which the answer is:
>There is no way to "give" ownership to someone, only take.
Well, my program isn't the only way (and 2000 of those lines
are actually implementing a generic security API, not anything
to do with chown). There are many other utilities out there
that will do this - the main thing is to give people *accurate*
information, not repeat vendor mis-information.
>If you would like to re-write Microsoft's OS, by all means, feel free to
>- you should be working for Microsoft I would think, otherwise, don't
>get so bent out of shape there Jeremy.
Well if they published the source I'd be interested in
fixing the ACL gui to do just that :-).
>I would sure hope ownership has EVERYTHING to do with security on a
>LAN/WAN! I'm sure if Microsoft found it acceptable they would have
>included the ability to grant ownership to other SIDs.
No, not so. They did include the ability, they just didn't
add a GUI for it. There's the difference.
>Ok.. now we're getting to the root of your anger... you don't like
>Microsoft.
No, I have a fine relationship with MS. I don't like
incorrect technical information - whatever the source.
>I'd rather work with and support an OS that I like and grow with it
>rather than simply try to poke holes in it every chance I get - that's
>too easy.
As do I. But poking holes in it is a *good* thing to do. It
improves the product. If no-one ever complained nothing
would ever get fixed.
>I don't have time to chase every single "what if" and "hack" thread with
>regards to Microsoft or any other enterprise wide NOS - I'll just take
>your word for it.
Thanks.
>Why don't you write a book and have it published?
Good advice. I may follow it :-).
Cheers,
Jeremy Allison.