When it says "every local administrator user ... have the same password" is it referring to accounts defined in the local SAM? 'Cause you don't need absolutely need those. Do those local accounts need to be enabled? Either randomize the "Administrator" account passwords and/or disable the Administrator account, and do administration via domain accounts (that are members of the local administrators group).
Carl From: James Rankin [mailto:[email protected]] Sent: Thursday, October 22, 2009 7:56 AM To: NT System Admin Issues Subject: Hmmm....anyone have any thoughts on this? http://securitytube.net/How-to-own-a-Windows-Domain-video.aspx Or mitigating against it, specifically....although I am not sure how effective an attack this is. I would think blocking USB access and maintaining application whitelists would be my personal first step. -- "On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question." http://raythestray.blogspot.com ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
