NT User Manager for Domains safety

1.IIS 的FTP服务,在不允许匿名连接的情况下,对仅属于Domain user组的用户是禁止登录ftp的,但是,如果某个这样的用户用Getadmin等漏洞取得了operator组或者Administrator组的权限后,再登录一次ftp,成功进入,经过这样一个步骤后,再把这个用户从operator组或Administrator组删除,只要server不重新启动,他在这个组的权限对ftp服务仍然有效,仍然可以登录ftp.例如,你本来是域的工作站用户chen,属于Domain user组,NT不允许你在server上登录,也不允许你进入ftp,用本站的Getadmin等方法,你得到了Administrator的权限,把 chen加到了Administrator组,这时你要用一下你的权限,比如ftp,当然是可以进去登录了,用完后你就可以从域用户管理器中把chen从 Administrator组删除了.这使管理员看不出有什么变动.只要Server不重新启动,你仍然有ftp的权限.(记住,如果你不使用ftp成功登录一次是不能达到这个效果的. 1.IIS the FTP service does not allow anonymous connections in the case, only the user belongs to Domain user group login ftp is prohibited, but, if a user with this and other loopholes made Getadmin operator group or of the Administrator group permissions, then log in once ftp, successfully entered, after such a step, then the operator group or user from deleting the Administrator group, as long as the server does not restart, he was in the group permissions are still valid for the ftp service, you can still log in ftp. For example, you could have been the domain of the workstation user chen, belongs to Domain user group, NT does not allow you to log in the server, does not allow you to enter the ftp, site Getadmin with other methods, you get the Administrator's authority to chen added to the Administrator group, then you use what your rights, such as ftp, of course, you can log into, and after you can use User Manager for Domains in the chen removed from the Administrator group, which allows administrators to do not see any change as long as the Server does not restart, you still have ftp privileges. (Remember, if you do not use ftp successful login can not achieve this effect.

2、在我们对NT server的管理中,我们离开机器时喜欢对工作站进行锁定,但是,如果你刚刚在域用户管理器中改了密码,而不重新登录直接锁定的话,新密码无效,要旧密码才能解锁.这就提醒管理员,如果你发现密码被窃或者不安全,改了密码以后,应该重新登录一下而不要锁定工作站,这样旧密码的作用才会失效. 2, in the management of our NT server, we prefer to leave the machine to lock the workstation, but if you just change the Domain User Manager password, log in directly without re-lock, then the new password is invalid, to the old password to unlock. This reminds administrators, stolen, or if you find insecure passwords, change the password, the log should look and do not lock the workstation, so the role of the old password will fail.