ALL our domain computer accounts (machinename$) have the "access this computer from the network" right on all desktops. They are also in the DOMAIN USERS group but they are NOT in any power/admin local/domain groups. Since these accounts can be used by an end user, via "psexec -s -i -d cmd.exe" on their local domain desktop - can this usage enable any sort of wmic winrs bitsadmin on other domain machines that are on the network? This cmd enables the usage of the account without knowing it's password but gaining its ability to touch the other machines on the net. I can regedit- enumerate ids, policies, share NAMES.. depending on the permissions set. It seems to me that we need to remove this right to prevent usage of such tools (esp the winrs wmic bitsadmin) on other domain computers. The w cmds and bitsadmin I cannot yet get to work across the network. Anyone have any thoughts on this? Yes - I am a bit paranoid on this... :)
-
1You basically already answered you own question. Like you said: It depends on the permissions set. If cautiously set, there should not raise any security issues from this.– faroschJan 24, 2017 at 22:01
1 Answer
Taken from here:
Vulnerability
Users who can connect from their computer to the network can access resources on target computers for which they have permission. For example, the Access this computer from the network user right is required for users to connect to shared printers and folders. If this user right is assigned to the Everyone group, anyone in the group can read the files in those shared folders. This situation is unlikely because the groups created by a default installation of Windows Server 2012, Windows Server 2008 R2, Windows 8, and Windows 7 do not include the Everyone group. However, if a computer is upgraded and the original computer includes the Everyone group as part of its defined users and groups, that group is transitioned as part of the upgrade process and is present on the computer.
Countermeasure
Restrict the Access this computer from the network user right to only those users and groups who require access to the computer. For example, if you configure this policy setting to the Administrators and Users groups, users who log on to the domain can access resources that are shared from servers in the domain if members of the Domain Users group are included in the local Users group.
