So, for example, if the other user had admin rights, the user could launch lusrmgr.msc and give themselves admin rights. It should not be a domain account, but instead granted admin rights on the local PC.ĮDIT: Another "elevation of privilege" problem here is that the address bar in IE can serve the same as the "run" dialog in Windows, so the user can run any arbitrary application that the other user can. If you use a domain account (because you need to access domain resources), it should be a unique account just for the actual user.
To mitigate exposure, use an "admin" account that local to the PC, not a domain account. If you choose to do this, NEVER use domain admin credentials. The other problem is that the application runs in the other user's context, meaning that when you go to save downloaded files from IE, IE will access resources as the other user, not the actual user. Although you can't run Windows 8-style apps as an administrator, you can launch the full Internet Explorer 11 program in Administrator mode. The problem is that the other user's credentials are cached in the user's profile, which provides an avenue of privilege escalation for other applications. How to Run Internet Explorer in Admin Mode. It is possible to create a shortcut that uses cached credentials of another user (such as a user with admin rights).
0 kommentar(er)
