|
Posted by Roger Abell [MVP] on January 13, 2007, 10:07 pm
Please log in for more thread options
>> > Security Policy for the Domain Controllers includes a Security Option
>> > to
>> > "Deny Login to This Machine From Network". I want to enforce
>> > administration of domain controllers by logging into the console, or by
>> > logging in through Terminal Services. I don't want Administrators
>> > exercising their privilege level over RPC, over file sharing, etc.
> Can
>> > I
>> > simply add the Administrators group to the Deny Login from Network
>> > security
>> > option for the domain controllers to prevent such exposures?
>> >
>> > Are there other group policy options I should be changing at the same
> time
>> > to further enforce the above requirements?
>>
>> PS. Yes can do so provided you do want no administrative
>> account to have ability to use what is denied. I mean, it will
>> not break Windows, perhaps some post-install enterprises
>> applications or service usages, but not Windows.
>
>
> It turns out that Microsoft implements user group policy updates during a
> *local* login by *using the network path* to do the update. By adding
> administrator to the Deny Access from Network User Privilege, you lock out
> the administrator account from group policy updates when you do a local
> login!!
>
> That by itself might not be a fatal thing, and you might even incorporate
> moving the user in and out of that group when you need to do local
> administrative tasks, but once you remove the user it doesn't change
> anything. You are in a catch 22 where the user cannot apply the updated
> GPO because it cannot use the network with its current security policy!
> Nice design :)
>
Will,
As I said last week in a post to yourself. The access requirements are
simple: for DCs every account (user or computer) needs access to DCs;
for non-DCs no domain account must have access to the member.
That you can break GP application is true, as well as a host of other
things dependent on the access (DFS dereference if replica there,
login scripts, software install, etc.). Those however did not break
Windows per se, it is there and stable; you impaired features.
Again, I am attempting to understand you underlying objective, as
I have a feeling that the design intent is to use a different approach.
Roger
| 
XML Sitemap