Domain Administrator, has no rights on Local Machine

[FlavesEnt]

Hello all.

I am an administrator for a k-12 school. A "clever" student has recently figured out how to change one system on a laptop cart that we have, which disables any user from having more than basic privilages on the machine.

For instance, as a Domain Admin, I actually have no rights. I can not access User Accounts in Control Panel, and do not have any more rights than one of the basic users.

Students have restricted accounts that we run via group policy on the domain.

All the laptops have no CD or Floppy drive, however, students have USB Flash Drives, which they can access data on.

The Local Administrator account is gone in Documents and Settings, however a folder named DIESEL appears.

I can find no trace of any programs installed on the machine that would allow hacking of the system.

At this point I will probably have to rebuild the system, unless a more appropriate soloution can be offered.

Any help is appreciated.

Thanks.

Dan

 

[DestinysDream]

Yeah it's called a paddle.

If anyone calls and says "I know a little something about computers" just tell them to reformat it.

 

[franklin97355]

We use a program called Deepfreeze and it's saved us a lot of hassle. Don't know enough to help you fix your problem though, we usually have a ghost image of our computers and reghost them when all else fails.

 

[FlavesEnt]

What exactly does Deep Freeze do?

We use Ghost also, but I wanted to try to prevent the problem in the future, and to do that, I would have to find out what exactly the student did, and lock it down.

I was hoping to find out how this could be done, since Group Policy restricts this behavior.

 

[bcastner]

It is an easy use of Google to find software utilities to change the local Administrator account password to either blank or something else.

As a local Administrator I could make all the changes you describe.

Deep Freeze would certainly work in this instance:

http://www.faronics.com/

 

[aquias]

As to how the student did it...probably ran a crack against the local sam database via a jump drive. Once that's done he's got an admin username and password to work with.

Another method to help prevent this, is to put a policy in place. Set the policy up so only approved applications can be run on any system. This SHOULD lock out their capability to break any type of encryption...

Another method is having a proxy in place to monitor and block access to specific types of content from the web.

 

[bcastner]

Won't work aquias -
The password / SAM editors I have seen run from a small Linux boot.

Group Policy means nothing in this instance.

Now you could block the use of USB pen drive devices, but that is apparantly encouraged at this site.

 

[bcastner]

As a side note, I carry a 1gb USB pen drive with a customized version of this installed:

http://www.windowsubcd.com/index.htmall/other/motherboard/win2k.htm

(See the list of utilities included by default)

And, a 512MB pen drive with this installed: Knoppix

http://www.knoppix.net/get.php