Seriously, Least Access -- Redmondmag.com

Windows Tip Sheet

Seriously, Least Access

Run legacy apps without hitting the security barrier.

By Don Jones
04/23/2004

I recently gave a talk to a bunch of network admins who work for a BrainCore.Net client. We were talking about security and the Principle of Least Access—you know, the idea of logging onto your computer with an ordinary user account, and never logging on with an administrator account, because if you happen to (for example) get hit by a virus or something, that ordinary user account will offer less power for the virus to take advantage of. They said they'd love to do that. In fact, they'd tried once, using Windows XP's RUNAS command to execute administrative utilities under a separate administrator account. But it turned out many of their users' apps—legacy apps, that is—required administrative privileges, so they had to abandon the idea. No way!

The Legacy Solution
One reason a legacy app might "need" administrative rights is to get free access to the HKEY_LOCAL_MACHINE portion of the Windows registry, a portion which ordinary users have read-only rights to. It's a horrible programming practice on the part of the application developer, but that's why we call these things legacy apps, right? Easy fix, though: Simply apply the "compatws" security template to computers that run the app. This template, included with Windows, dumbs down security on HKEY_LOCAL_MACHINE so that users have more access. You will be opening the door to greater security threats, since many viruses try to modify HKEY_LOCAL_MACHINE if they can get to it, but you won't be as wide-open as you would if all your users were administrators.

And RUNAS isn't just for using administrative applications like AD Users & Computers! It can also be a solution for those legacy apps. Here's how: Remove all Desktop and Start menu shortcuts to the app and replace them with shortcuts that launch the application by using RUNAS. In the shortcut's command-line, simply specify RUNAS, along with a user account that has the needed privileges. Users will be prompted for a password when the application runs, but that's surely a better thing than leaving your entire network, or the user's computer, open to bigger threats.

What user account should RUNAS utilize? That depends. If the legacy app in question only accesses local system resources, then have RUNAS use an alternate local user account that's a member of the local Administrators group (or Power Users, or whatever you need to get the app to run). That local account won't have domain-wide privileges, so any damage done by the legacy app (or by something the legacy app launches) will be restricted to the local machine. Worst-case would be to use a domain user account that's a member of the local Administrators group, which is what you'd need to do if the legacy app needs network access. That domain account won't usually need to be a Domain Admin, though, so the damage it can inflict on the network should still be limited.

Micro Tip Sheet

Ever try to consolidate Security event log information from a hundred servers? Don't—it's a painful process without tools. Watch the Windows Server 2003 Web site for an upcoming feature pack named MACS, the Microsoft Audit Collection Service, which will do the grunt work for you.

Still getting annoying pop-up ads in Internet Explorer? IE is the last major browser to include integrated pop-up blocking; it'll be included in an upcoming service pack. In the meantime, try the free Google toolbar (http://toolbar.google.com), which now blocks popups in IE.

More Resources
Read about the RUNAS command on Microsoft's Web site: http://www.microsoft.com/resources/documentation/WindowsServ/2003/
enterprise/proddocs/en-us/Default.asp?url=/resources/documentation/
WindowsServ/2003/enterprise/proddocs/en-us/
windows_security_runas_shortcut.asp

Read about the Windows service that makes RUNAS possible: http://www.microsoft.com/windows2000/en/server/help/default.asp?
url=/windows2000/en/server/help/sys_srv_secondary_logon.htm

About the Author

Don Jones is a multiple-year recipient of Microsoft’s MVP Award, and is Curriculum Director for IT Pro Content for video training company Pluralsight. Don is also a co-founder and President of PowerShell.org, a community dedicated to Microsoft’s Windows PowerShell technology. Don has more than two decades of experience in the IT industry, and specializes in the Microsoft business technology platform. He’s the author of more than 50 technology books, an accomplished IT journalist, and a sought-after speaker and instructor at conferences worldwide. Reach Don on Twitter at @concentratedDon, or on Facebook at Facebook.com/ConcentratedDon.

Featured

Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.
What's Inside Microsoft 365's Security Toolbox?

Microsoft provides plenty of native tools to secure Microsoft 365. IT pros just have to know where to look.
Microsoft Kills 30-Day Data Retention Policy for Copilot in Fabric

Microsoft this week announced several usability improvements coming to Copilot in Fabric in preparation of its general availability release later this year.
Using Microsoft Office to Build a Network Diagram 2

Now that we've set up our process, let's dig in with the actual execution.
Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.