Below I have put together everything I learned about Starting/Stopping a Windows Service from a non-Admin user account, if anyone needs to know. Primarily, there are two ways in which to Start / Stop a Windows Service. 1. Directly accessing the service through logon Windows user account. 2. Accessing the service through IIS using Network … Read more
It’s a limitation of legacy Unix systems, and the NIS directory service in particular. Usually, this restriction is just in place if the organization is trying to keep usernames consistent across all applications (which is generally a good idea).
You can use passwd to gather some information e.g. if an account is locked passwd -S user user LK 2012-11-06 0 99999 7 -1 (Password locked.) (CentOS) user L 01/22/2013 0 99999 7 -1 (Ubuntu) The chage utility will provide information about the various timers on an account e.g. for an unexpired password chage -l … Read more
I’m at a Tier 1 PCI vendor. We have something like this in place, with a few differences. The auditors are actually attempting to describe a very real problem, but doing an incredibly poor job explaining the implications and needs analysis. It is now more effective to compromise a system by using a hash of … Read more
I am generally a fan of “One user for anything that opens listening socket on the network” — One for Apache, one for Mail, one for DNS, etc. This is (as last I heard) still Best Current Practice, and the reason behind this is plain and simple paranoia: These services are exposed to the Big … Read more
Though I haven’t personally tested, I have good reason to believe that the above stated AT COMMAND solution will work for XP, 2000 and Server 2003. Per my and Bryant’s testing, we’ve identified that the same approach does not work with Vista or Windows Server 2008 — most probably due to added security and the … Read more
FreeIPA is probably what you’re looking for. It’s to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn’t be used to manage Windows machines directly. Use AD for that.) Red Hat’s documentation (they call it Identity Management) is very thorough and easy to … Read more
You’re correct, the Power Users group does not do anything at all in Windows Vista and later. From http://technet.microsoft.com/en-us/library/cc771990.aspx: By default, members of this group have no more user rights or permissions than a standard user account. The Power Users group in previous versions of Windows was designed to give users specific administrator rights and … Read more
If you declare users as virtual resources , you can then use ‘realize’ or the collection syntax ( User <| … |>). Here’s an example: @user { ‘foo’: groups => [‘somegroup’], membership => minimum, } Then realize that virtual user with then collection syntax: User <| title == foo |> And elsewhere you can add … Read more
Before adding a user one must first create a login. Logins can only be created in the servers Security-folder (not in the databses Security). So the login can be created under <server>/Security -> Right-Click -> New -> Login…. A user with the same name and settings will automatically be added to the databases selected in … Read more