RE: Insufficient Authentication vulnerability in Asus notebook

[Steve Quan <sq01 () yorku ca>]

Is there something like su/sudo in the Windows world ? How do windows 
administrators handle this (ie accountability) ?

/Steve
---
On Thu, 14 May 2009, Mike Wilson wrote:

> A better option is to set a strong password and set a local policy that the local admin account cannot be accessed over the 
> network.  I'm a big advocate of that in all environments and prevents the need for renaming the account to prevent 
> automated attacks.
>
> Thanks,
> _________________________
> Mike Wilson
>
>
>
>
> -----Original Message-----
> From: Susan Bradley [mailto:sbradcpa () pacbell net]
> Sent: Thursday, May 14, 2009 2:39 PM
> To: my.security.lists () gmail com
> Cc: MustLive; bugtraq () securityfocus com
> Subject: Re: Insufficient Authentication vulnerability in Asus notebook
>
> We're talking XP Home here, right?  A admin account without a password
> cannot be access remotely over the internet, so if you have physical
> access at all times of that Asus netbook it's arguably more secure in
> some circumstances.
>
> nameless wrote:
> > Susan Bradley wrote:
> >
> > > 3.  For XPs it's kinda handy to have a blank admin password when you
> > > sometimes come in on a network and need to get to that particular
> > > machine and you didn't set it up, otherwise you have to use the Admin
> > > password boot disk trick and reset the password to blank.
> >
> > You should only do the above recommendation, if you like to have your
> > boxes owned.
> >
> > You should not have any administrative accounts named "Administrator"
> > and _all_ administrative accounts should have a _STRONG_ password
> > associated with them.
> >
> > No exceptions.
> >
> > Password safes are available at no charge.  If you somehow forget your
> > password, you can always reset it via AD or resetting the SAM.
>
> *** NOTICE--The attached communication contains privileged and confidential information. If you are not the intended 
> recipient, DO NOT read, copy, or disseminate this communication. Non-intended recipients are hereby placed on notice 
> that any unauthorized disclosure, duplication, distribution, or taking of any action in reliance on the contents of 
> these materials is expressly prohibited. If you have received this communication in error, please delete this 
> information in its entirety and contact the Amedisys Privacy Hotline at 1-866-518-6684. Also, please immediately notify 
> the sender via e-mail that you have received this communication in error. ***