Printable View
If I hide the RUN icon and all MSDOS icons, control panel and printer, etc. using policies. DO anyone of you know another way that someone can get acces to the C: prompt on my lab???.
I tested the help menu, but it only let you access several stuff, like add/remove hardware. Is there any other way?, I don't want anybody messing around with my servers, and I think somebody is doing it.
OS = Win98SE
C ya
Oso
With a bootdisk with command.com on it.
Change boot order sequence to hardrive first.
With the "boot into DOS mode" option during shutdown. They may also bring it up using explorer.exe Hope this helps...
Happy Hacking
I forgot about this, there are all kinds of registry tweeks. www.happyhacker.org and www.winreg.com i think
or www.regedit.com
not really sure
do a google you'll find em
Well, the point is that users are not able to restart, because I would noticed it. So somebody found a way to access DOS...
Any ideas, I will try some stuff tomorrow and let you all know.
(No one is gonna mess with my network security!!!)
One more thing!.
if you use Internet Explorer you can use the web url addy bar at the top as a place to access commands that are only allowed in the C:\prompt. It's basically like the same thing as your my computer, you know where you can type in the path to your files.
Also you can create a batch file in notepad, and reboot your machine, When it loads back on it will make corrections and could possibly re-load the run command. Or you can go to the regedit and put back the run command. You could also reboot in Safe Mode and easily correct the registry to allow the run command. (that is the easiest way).
you can start it as a scheduled task.
you can type command in notepad, save it to the desktop as a batch file and run it.
Hitting F8 during boot usually gets you the question wether you want to boot normal, in safe mode, or with dos-prompt....
isn't there an option in poledit to not allow single mode dos apps or maybe don't allow dos at all. i don't have poledit on my computer here but when i get to work tomorrow ill check it out.
Read below....
You're right tedob, there IS a way to prevent access to the dos prompt in the policy editor.
BTW, it's all alot easier than you are all thinking. If a user is able to run command.com, then all he/she has to do is create a shortcut to it.
No need to make a batch file or anything. ;)
In addition, some Windows versions offer help menus for the old file manager. This is the case with NT4.0. Although not a dos prompt, it is a very effective dos shell that is available even if policies are prohibiting a dos prompt.
I have never had any problem deleting winfile.exe as one more hole plugged.
So, basically the quickest way (if it's there) is fastfind? Just a thought. Also, The Microsoft BackOffice 4.0 Setup utility creates a file called
REBOOT.INI in the
\Program Files\Microsoft BackOffice
directory which contains plaintext userIDs and Passwords for, at least,
the SQL Executive Logon account, the Exchange Services Account, and the
MTS Remote Administration Account, if supplied during BackOffice Setup.
Other user account passwords may be recorded in this file during setup
In addition, some Windows versions offer help menus for the old file manager. This is the case with NT4.0. Although not a dos prompt, it is a very effective dos shell that is available even if policies are prohibiting a dos prompt.
I have never had any problem deleting winfile.exe as one more hole plugged.
Good call Vaness! Btw, this is the rest of the text..this was actually in our text files, so it's paste...give it up where it's due, right? Anywho, for not wanting to re-write the bible, here it is:Hope this is useful to all.
This may sound like a bit of a Troll answer, but maybe you should consider upgrading to Windows 2000 if you are so worried about security. There will always be ways for users to get around anything you do in Windows 9x cause there is no real file security. If you upgrade to 2000, however, you will be able to limit the user's access to only certain files that they need and no more, plus Active Directory gives you a TON of options on how to get rid of stuff from their PCs that you probably don't want them messing with. All this while still allowing you to logon as an administrator and perform your duties.
I suggest seriously looking into the Win 2k upgrades, I'm telling you there is no way you'll stop an intelligent person from messing with files on a Windows 9x PC.
-Wizeman
No install *nix if you want REAL security.Quote:
Originally posted by Wizeman
but maybe you should consider upgrading to Windows 2000 if you are so worried about security.
I'm certainly not going to get into a flame war about which is better, a *nix or Windows 2000, but I'm going to say that in this particular case students need to use these PCs, they obviously have an existing Windows-based infrastructure, and Windows can be secured very well if you are knowledgable enough about it (go look for the Windows 2000 security guide on www.nsa.gov). Given that the students probably have no experience with *nix, that the programs they use probably aren't ported to *nix, and that they don't want to spend lots of $$ doing a complete infrastructure switch-over, then I would say that Windows 2000 is the best solution for what he is looking for. Besides, as far as file security goes, Windows and *nix uses the same principals (groups and users).
I would have to agree that if you want to protect the computer from somebody sitting at the terminal, any DOS-based OS is not going to cut it. Since there is no file level security, there will always be a way to get at files, unless you've gone so far as to make the operating system unusable.