Re: NT 4.0 (Workstation) Logon Authentication Vulnerability

[Phil.Cox () SYSTEMEXPERTS COM (Phil Cox)]

> Problem:  I believe WinNT may cache user passwords.  This
> allows a user to disconnect a terminal from the network and
> login to the workstation locally without being
> authenticated by the PDC or BDC.

Well known "feature"
 
> Vulnerability:  A malicious user may disconnect a machine
> from the network and add/remove software without being
> audited by the PDC/BDC.  Also, a user who has been deleted
> from the domain users list may still have access to a
> machine which he/she had used in the past.

Yep, but they still only have whatever rights and permissions they had before.

FIX: Set the following registry value to 0.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount

This will disable cached logons. If you do this for your mobile users, they will probably string you up, as they won't 
be able to logon if not connected to the domain ;(

Phil
--------------------------------------------
SystemExperts Corporation
Philip C. Cox, Consultant

+1 (888) 749-9800 (Corp HQ, toll free, USA only)
+1 (209) 830-0595 (main)
+1 (209) 830-0594 (fax)
http://www.SystemExperts.com/