System Account

From: MC (anonymous_at_discussions.microsoft.com)
Date: 05/27/04 

Date: Wed, 26 May 2004 20:21:55 -0700

I have a Windows 2003 domain with all windows 2000 pro spk
4 workstations. I am in an educational system so I have
two main security groups, students and teachers. Both of
those domain security groups are part of the local users
group on the workstations. I have really tried to lock
down the workstations with group policy and NTFS
Permissions. Here is the problem. The local users group
has read only perms on the c:\ and also read only on Winnt
and program files. The System account has full control to
the entire drive. Users browse the internet and they
still have the ability (of which I don't know how) to
install such garbage as the google search bar or n-case or
other annoying "spyware" and "ad ware". I don't
understand how this stuff is getting installed or better
yet how it is able to be installed as a user account with
no rights to write to c:\, C:\winnt and c:\program files.
Through a GPO they also don't have the ability to edit the
registry yet all these things are able to be done. So my
question is, could these "spyware" be using the system
account? How safe is it to take the system account out of
the NTFS Permissions? How do these "spyware" get
installed? Any ideas I would really love to hear them,
thanks.

MC

Relevant Pages

  • Re: Many Installations of MSSQLSERVER.
    ... > target workstations by putting the workstations into an OU and/or ... > If these people's accounts are in the local Administrators or Power Users ... > you can install MSDE on workstation, or if you install the SQL server CD, ...
    (microsoft.public.windows.group_policy)
  • Re: Fax Services
    ... I have installed the fax client on the workstations, ... It has the server Fax available on printers & faxes. ... > To the problematic workstation issue, we need to install the Shared Fax ...
    (microsoft.public.windows.server.sbs)
  • Re: Many Installations of MSSQLSERVER.
    ... > target workstations by putting the workstations into an OU and/or ... > If these people's accounts are in the local Administrators or Power Users ... > you can install MSDE on workstation, or if you install the SQL server CD, ...
    (microsoft.public.sqlserver.security)
  • Re: Many Installations of MSSQLSERVER.
    ... > target workstations by putting the workstations into an OU and/or ... > If these people's accounts are in the local Administrators or Power Users ... > you can install MSDE on workstation, or if you install the SQL server CD, ...
    (microsoft.public.win2000.security)
  • Re: Many Installations of MSSQLSERVER.
    ... > target workstations by putting the workstations into an OU and/or ... > If these people's accounts are in the local Administrators or Power Users ... > you can install MSDE on workstation, or if you install the SQL server CD, ...
    (microsoft.public.win2000.windows_update)
Loading