Winxp Multi-user cross-accessing info/pw/etc?

Yes, the topic im looking for, as i will describe, was posted here at AO. I have tried searching all keywords, but didnt find what i wanted after 30pages. if anyone knows about this, please drop some words or a link perhaps.

Lemme detail what i mean by "Winxp Multi-user cross-accessing info/pw/etc." (isnt close to the title of thread i was looking for)

so, i read in one of these discussions that multi-user computers for a public network stores current users' info/docs/cookies/logs somewhere. i have seen that you can tell who has been on at that computer (assuming that these computers auto-format each night) for that day in"C:\Documents and Settings\". their user names will be displayed with locked data. i did briefly read that one could access such data/passwords that were just recently stored on those machines, not using admin account. files created for the specific user was meant to hasten access time to that user, because it takes much longer to talk to network server everytime and would slow down the network if server kept getting spammed by old users.

what do u know about such access?

You don't need to reformat the PC every night to know who's been on the computer. Just turn on logon/logoff auditting. If you really want to know what's happening turn on the object and file audit trails. Beware though, the logs can get pretty big pretty fast.

As for the passwords.. I believe you're looking for the cached credentials?
http://www.irongeek.com/i.php?page=security/cachecrack

reformating was directed towards the public computers which are set to re-imaging daily. i could tell by looking in the "C:\Documents and Settings\". i guess it may not be that important, 'cept knowing who was on that day.

anyway, i guess i already knew about cache cracking with admin/system level via cachedump/cain/johntheripper. can this be done with limited access? running .exe will be prohibited.

well, bar some bug I am unaware of files should have the correct permissions set so that users can not access each others cached files on the local PC. In fact, on our network at least it seems that the local cache is cleared out at log off, since every time I look in there there are actually no files in the folders.

AFAIK...if the system is installed on an NTFS partition...then the users profiles can only be accessed by an admin of the machine.

By default.....Limited users cannot access other user info.

MLF

ergo, the system is secure from limited users attempting to extract available hashes. correct?

how does one enable cache clear per login? or is this default in winxp?

Quote:

---

Originally Posted by e><ius

reformating was directed towards the public computers which are set to re-imaging daily. i could tell by looking in the "C:\Documents and Settings\". i guess it may not be that important, 'cept knowing who was on that day.

anyway, i guess i already knew about cache cracking with admin/system level via cachedump/cain/johntheripper. can this be done with limited access? running .exe will be prohibited.

---

Uhm, what the hell kind of environment are you discussing, where systems get reformatted every night? That is not exactly SOP for many organizations. I can see several situations where it may be exactly the sort of security measure needed, but this is by no means default, and you really should fill us in on more detail before we can try to answer your query.

generalizing public computers as i mentioned. not offices, home, but schools, libraries, internet cafes, you name it.

is that clear?

im guessing you cant answer my questions in my post before this.

You mean using software such as Faronics' "Deep Freeze" to restore systems to their original/standard configurations after use?

Is your concern that such a restoration will remove the records of who has used the machine?

no, i am certain that deep freeze or simliar apps will work fine. that is off topic.

this is what im asking:
Could a hacker withdraw user/pw hashes from a system knowing that that computer has stored hashes? but the catch is here- he has a limited account in this public machine.

Quote:

---

Originally Posted by morganlefay

By default.....Limited users cannot access other user info.

---

cant be 100% true.

Quote:

---

Originally Posted by me

how does one enable cache clear per login? or is this default in winxp?

---

Answer?

Quote:

---

i did briefly read that one could access such data/passwords that were just recently stored on those machines, not using admin account. files created for the specific user was meant to hasten access time to that user, because it takes much longer to talk to network server everytime and would slow down the network if server kept getting spammed by old users.

---

That is incorrect. XP holds the last 10 login/passwords by default. The idea is that users can still log in even if the domain controller or ADS tree cannot be found.

The question of recovering a password would depend on how the machine was accessed. If you want to stop it you have to make sure that the machine is locked down and locked up (physically). If people can boot from live CDs you won't be able to stop it.

Quote:

---

Originally Posted by nihil

The question of recovering a password would depend on how the machine was accessed.

---

what do u mean here?

I am referring to the fact that if a user can access the BIOS set up or if the machine will boot from a CD, DVD, USB drive, floppy or whatever, they can bypass the Windows boot process and its security settings, and extract the password hashes.

You can lock the BIOS and thus the boot sequence, but you would need to lock the device physically to prevent the BIOS from being reset or reflashed ;)

This is a typical security problem in the type of public environment that you describe. The more you lock down the machines the less functional they become. On the other hand the more functionality you allow users, the more exposed you are.

e><ius,

It seems to me that it would be useful if we defined the particular environment you are concerned with?

My understanding is that it is a college or PRIVATE library scenario, where you do have an identifiable authorised user community?

In effect, users can move around the premises and use various machines to access servers to which they are authorised, and which authenticate them as bona fide users?

Because there are numerous users, the same machines can be used by a number of people?

Your problem is that Windows NT systems store the last 10 login credentials (including the password hash), and you are concerned that a malicious user could retrieve these?

My suggestion is that there is no real benefit in storing the logins on local machines anyway?

Please check these instructions for preventing the local storage of login credentials (set the value to zero):

http://www.windowsnetworking.com/nt/.../rtips36.shtml

If they are not stored, they cannot be retrieved and abused :cool:

OK, if your servers go down then your users will not be able to login to their profiles, but that is the price you have to pay.............. well, they have to pay, to be precise :D

well, if the server is down theres not a lot you can do anyway. No home area.

That is true, I was thinking more of commercial and administrative environments where you may want a local "thick client" capability.

That should not be a problem as these areas would normally have much better physical security than student labs and libraries.

:)