Encrypting Administrator's profile

Posted: 01-09-2009, 10:45 AM
Is there any way to encrypt (EFS or similar) the entire administrator's
profile folder (C:\Documents and Settings\Administrator) so as to prevent a
user from login in to the computer if he changes the password with a dos
utility? (CIA Commander for example).

There's no point in having domain policies if the user can login as the
administrator and do whetever he wants with the computer!

What else do you suggest? (please don't say "put a bios password" or "forbid
physical access to the computer")

Thanks a lot!



Encrypting Administrator's profile


Responses to "Encrypting Administrator's profile"

Shenan Stanley
Guest
Posts: n/a
 
Re: Encrypting Administrator's profile
Posted: 01-09-2009, 03:24 PM
Kirsten wrote:
> Is there any way to encrypt (EFS or similar) the entire
> administrator's profile folder (C:\Documents and
> Settings\Administrator) so as to prevent a user from login in to
> the computer if he changes the password with a dos utility? (CIA
> Commander for example).
> There's no point in having domain policies if the user can login as
> the administrator and do whetever he wants with the computer!
>
> What else do you suggest? (please don't say "put a bios password"
> or "forbid physical access to the computer")
Why is this user able to logon as an administrative level account in the
first place?

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


Kirsten
Guest
Posts: n/a
 
Re: Encrypting Administrator's profile
Posted: 01-09-2009, 03:53 PM
He's not, but there are several utilities that easily disable the
administrator account.

"Shenan Stanley" <newshelper@gmail.com> wrote in message
news:%23I7wn5mcJHA.2444@TK2MSFTNGP06.phx.gbl...
> Kirsten wrote:
>> Is there any way to encrypt (EFS or similar) the entire
>> administrator's profile folder (C:\Documents and
>> Settings\Administrator) so as to prevent a user from login in to
>> the computer if he changes the password with a dos utility? (CIA
>> Commander for example).
>> There's no point in having domain policies if the user can login as
>> the administrator and do whetever he wants with the computer!
>>
>> What else do you suggest? (please don't say "put a bios password"
>> or "forbid physical access to the computer")
>
> Why is this user able to logon as an administrative level account in the
> first place?
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>

Gordon
Guest
Posts: n/a
 
Re: Encrypting Administrator's profile
Posted: 01-09-2009, 04:04 PM
Kirsten wrote:
> He's not, but there are several utilities that easily disable the
> administrator account.
>
Sounds like some discipline is in order. If this is a workplace, make it
a sackable offence to install or use any software not authorised by the
company. If a home environment, just deny physically, access to the
machine until the user learns to respect computer security.


--
Asking a question?
Please tell us the version of the application you are asking about,
your OS, Service Pack level
and the FULL contents of any error message(s)
Shenan Stanley
Guest
Posts: n/a
 
Re: Encrypting Administrator's profile
Posted: 01-09-2009, 04:37 PM
Kirsten wrote:
> Is there any way to encrypt (EFS or similar) the entire
> administrator's profile folder (C:\Documents and
> Settings\Administrator) so as to prevent a user from login in to
> the computer if he changes the password with a dos utility? (CIA
> Commander for example).
> There's no point in having domain policies if the user can login as
> the administrator and do whetever he wants with the computer!
>
> What else do you suggest? (please don't say "put a bios password"
> or "forbid physical access to the computer")
Shenan Stanley wrote:
> Why is this user able to logon as an administrative level account
> in the first place?
Kirsten wrote:
> He's not, but there are several utilities that easily disable the
> administrator account.
Did you mean 'disable' or 'allow them to use' the administrator account?

You didn't want to hear it because you know it's true... "Physical access,
time and a little knowledge means anyone who sits at the machine basically
can own it..."

Are you protecting what's in the administrator account (should be much of
nothing) or is it you just don't want them using the account?

If the latter - your battle is lost before it was started. Encrypt all you
want - physical access can give the user another/the same administrative
account with a little effort and a few tools and time. Maybe not so much
the data in the profile - but there should be nothing in (files, etc) the
actual built-in administrator's account of importance anyway, IMO.

I think you need to divulge what it is you hope to accomplish in order to
better narrow the possible answers. What is the actual problem and need?

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


Mel K.
Guest
Posts: n/a
 
Re: Encrypting Administrator's profile
Posted: 01-14-2009, 02:38 AM
You can use a full disk encryption product to encrypt the entire hard drive.
FDE will prevent offline access to the hard drive, meaning you would not be
able to boot the computer into another OS and access the drive. Windows
Vista with BitLocker should do the trick. Vista SP1 made some improvements
to BitLocker.

--
Mel K.
MCSA: M

"Kirsten" <noreply@nospamplease.com> wrote in message
news:OHXGxdkcJHA.4660@TK2MSFTNGP04.phx.gbl...
> Is there any way to encrypt (EFS or similar) the entire administrator's
> profile folder (C:\Documents and Settings\Administrator) so as to prevent
> a
> user from login in to the computer if he changes the password with a dos
> utility? (CIA Commander for example).
>
> There's no point in having domain policies if the user can login as the
> administrator and do whetever he wants with the computer!
>
> What else do you suggest? (please don't say "put a bios password" or
> "forbid
> physical access to the computer")
>
> Thanks a lot!
>
>
>

 
LinkBack Thread Tools Display Modes
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
Moved Contacts to C:\Users over my profile and I have a copy of my profile under my profile in the explorer only. Josh Young Windows Vista File Management 4 09-28-2007 04:13 AM
Administrator's profile damaged David Windows XP Security & Administration 1 01-18-2004 01:37 AM
Recovery console took out my Administrator's user profile Dean Windows XP Security & Administration 0 12-21-2003 11:32 PM
encrypting ben Windows XP Help & Support 3 11-26-2003 06:03 PM
De-encrypting files Roger Bradley Windows XP Security & Administration 3 11-02-2003 11:22 PM