Winxp Multi-user cross-accessing info/pw/etc?

[e><ius]

Yes, the topic im looking for, as i will describe, was posted here at AO. I have tried searching all keywords, but didnt find what i wanted after 30pages. if anyone knows about this, please drop some words or a link perhaps.

Lemme detail what i mean by "Winxp Multi-user cross-accessing info/pw/etc." (isnt close to the title of thread i was looking for)

so, i read in one of these discussions that multi-user computers for a public network stores current users' info/docs/cookies/logs somewhere. i have seen that you can tell who has been on at that computer (assuming that these computers auto-format each night) for that day in"C:\Documents and Settings\". their user names will be displayed with locked data. i did briefly read that one could access such data/passwords that were just recently stored on those machines, not using admin account. files created for the specific user was meant to hasten access time to that user, because it takes much longer to talk to network server everytime and would slow down the network if server kept getting spammed by old users.

what do u know about such access?

[SirDice]

You don't need to reformat the PC every night to know who's been on the computer. Just turn on logon/logoff auditting. If you really want to know what's happening turn on the object and file audit trails. Beware though, the logs can get pretty big pretty fast.

As for the passwords.. I believe you're looking for the cached credentials?
http://www.irongeek.com/i.php?page=security/cachecrack

[e><ius]

reformating was directed towards the public computers which are set to re-imaging daily. i could tell by looking in the "C:\Documents and Settings\". i guess it may not be that important, 'cept knowing who was on that day.

anyway, i guess i already knew about cache cracking with admin/system level via cachedump/cain/johntheripper. can this be done with limited access? running .exe will be prohibited.

[zencoder]

reformating was directed towards the public computers which are set to re-imaging daily. i could tell by looking in the "C:\Documents and Settings\". i guess it may not be that important, 'cept knowing who was on that day.

anyway, i guess i already knew about cache cracking with admin/system level via cachedump/cain/johntheripper. can this be done with limited access? running .exe will be prohibited.

Uhm, what the hell kind of environment are you discussing, where systems get reformatted every night? That is not exactly SOP for many organizations. I can see several situations where it may be exactly the sort of security measure needed, but this is by no means default, and you really should fill us in on more detail before we can try to answer your query.

[Aardpsymon]

well, bar some bug I am unaware of files should have the correct permissions set so that users can not access each others cached files on the local PC. In fact, on our network at least it seems that the local cache is cleared out at log off, since every time I look in there there are actually no files in the folders.

[morganlefay]

AFAIK...if the system is installed on an NTFS partition...then the users profiles can only be accessed by an admin of the machine.

By default.....Limited users cannot access other user info.

MLF

[e><ius]

ergo, the system is secure from limited users attempting to extract available hashes. correct?

how does one enable cache clear per login? or is this default in winxp?

[e><ius]

generalizing public computers as i mentioned. not offices, home, but schools, libraries, internet cafes, you name it.

is that clear?

im guessing you cant answer my questions in my post before this.

[nihil]

You mean using software such as Faronics' "Deep Freeze" to restore systems to their original/standard configurations after use?

Is your concern that such a restoration will remove the records of who has used the machine?

[e><ius]

no, i am certain that deep freeze or simliar apps will work fine. that is off topic.

this is what im asking:
Could a hacker withdraw user/pw hashes from a system knowing that that computer has stored hashes? but the catch is here- he has a limited account in this public machine.

By default.....Limited users cannot access other user info.

cant be 100% true.

how does one enable cache clear per login? or is this default in winxp?

Answer?