Question for the Windows pros

[Paul Schmehl <pauls () utdallas edu>]

Win 2000 SP 4 and Win XP both incorporated two new security features; 
Create global objects and Impersonate client after authentication.  Both 
are restricted to Administrators, SYSTEM or other privileged accounts.

What are the risks associated with granting Authenticated Users (AD 2003) 
the Impersonate client after authentication privilege?  I've googled and 
read endlessly repetitive explanations for what the privilege is (most of 
them nearly incomprehensible), but I have yet to find anyone who 
articulates the risks associated with such a change.  ISS claims it's a 
HIGH risk but then gives no explanation why that is so.

Would this expose a workstation to a Blaster-type worm, for example?  Open 
it up to remote attack?  If so, what is required to conduct the attack? 
What ports would be involved?

Pointers to white papers or talks at conferences would be greatly 
appreciated.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/