Disable administrators group?

Should you have problems with the MS logon plugin, here's the place to look for help or report issues.

Disable administrators group?

Postby spud » 2006-10-27 15:41

I have a bunch of machines that are not part of a domain and only use local security.

Is there any way to only use the MS Logon I groups that I specify, but not allow the Administrators group to have access?
spud
 
Posts: 3
Joined: 2006-10-27 15:15

Re: Disable administrators group?

Postby bevtech » 2006-10-27 21:15

you should be able to limit uvnc by username using the mslogon authenication..

But for uvnc to function as a service you need to have admin rights.


You could try application mode just not sure how the mslogon will like that..;)
Bevtech

Windows XP Home, Pro SP2, Windows 2003 SBS server SP2(EN), Windows Media Center Editon 2005,Windows Vista Home Prem.,Fedora Core 6,Win9X, PChelpware Rel 1.0,
UVNC V 1.0.8.2

User not developer..;)
bevtech
Super-Mod
Super-Mod
 
Posts: 2191
Joined: 2005-08-03 14:07
Location: Pennsylvania, United States

Re: Disable administrators group?

Postby spud » 2006-11-02 22:43

The problem is not what rights it takes to run the VNC server service, the problem is the fact that any user who has a local account on these machines can also remote to those machines. This is because all the users who have accounts on these machines are in the "administrator" group. I am trying to limit who can use VNC to remote control to these machines, but the default install seems to always allow the "administrator" group full access. Changing the groups in the "configure MS Logon Groups" screen doesn't change the default "administrator" group's rights to do remote control to a machine.
spud
 
Posts: 3
Joined: 2006-10-27 15:15

Re: Disable administrators group?

Postby bevtech » 2006-11-02 23:51

hmm how about this??

ou can limit ips with Authost this may be an option


post #17374 in topic "Does AuthHost work?"

Limit by subnet..Just an idea but mslogon should be able to use any account for authenication. Cant you just create an account with restricted access??


I personally only use classical authenication with complex 8 char passwords along with the dsm plugins..;) that way you could always have different passwords for UVNC on different servers..
Bevtech

Windows XP Home, Pro SP2, Windows 2003 SBS server SP2(EN), Windows Media Center Editon 2005,Windows Vista Home Prem.,Fedora Core 6,Win9X, PChelpware Rel 1.0,
UVNC V 1.0.8.2

User not developer..;)
bevtech
Super-Mod
Super-Mod
 
Posts: 2191
Joined: 2005-08-03 14:07
Location: Pennsylvania, United States

Re: Disable administrators group?

Postby spud » 2006-11-07 18:43

Limiting by IP address won't work because we use DHCP. There are a number of techs who would need to use UVNC to support our users and these techs all would have DHCP addresses.

The problem is I need to be sure that no other people in our environment can remote to these machines. I was really hoping there was a way to only allow a specific "remote-access" group in the MS Login I screen and not have to worry about all the "administrators" group having access.
spud
 
Posts: 3
Joined: 2006-10-27 15:15

Re: Disable administrators group?

Postby bevtech » 2006-11-08 02:12

Try Mslogon II should let you specify user groups or if nothing else a user account
Bevtech

Windows XP Home, Pro SP2, Windows 2003 SBS server SP2(EN), Windows Media Center Editon 2005,Windows Vista Home Prem.,Fedora Core 6,Win9X, PChelpware Rel 1.0,
UVNC V 1.0.8.2

User not developer..;)
bevtech
Super-Mod
Super-Mod
 
Posts: 2191
Joined: 2005-08-03 14:07
Location: Pennsylvania, United States


Return to MS logon plugin

Who is online

Users browsing this forum: No registered users and 2 guests