User profiles don't run programs

[whythis]

I want to run my web server (2K Server) from a user profile, for security reasons. It has been "done in" before by hackers, behind a router and a firewall.
The problem is: When I use a user profile, the recursion utility that routes the websites doesn't work, and as it is already installed, I am at a loss for what to do. It works in the admin profile logon, but won't work for a user profile. I changed one of the admin logons to a user logon, and again the utility quit working.
Another serious issue: I can't prevent others from accessing the computer management utility or system utilities from the user logons. If I remove the admin utilities from the Documents and Settings for "All Users" (which can't be deleted, either!), then even the admin accounts can't access these areas. If they can be accessed, anyone can see all the account names and then only need a password cracker program to take control (which I know are available, but not sure how long a password they can crack). Of course, if they are already IN there....
If anyone can help, I am desperate! (Don't tell me to get a proxy. Can't afford it.)
Thanks whythisagainwhythisagainwhythisagain

 

[SkyHawkTech]

>I want to run my web server (2K Server) from a user profile, for security reasons. It has been "done in" before by hackers, behind a router and a firewall.

This is a horrible idea. IIS already has accounts defined for this. Changing or altering it as a user profile will really screw up the metabase and/or NTFS permissions.

IMHO if your server has previously been compromised then I would fdisk it out and completely re-install w2k server with all the patches and hotfixes.

Setup your web server iaw established M$ proceedures 'they' wrote it.

>The problem is: When I use a user profile, the recursion utility that routes the websites doesn't work, and as it is already installed, I am at a loss for what to do. It works in the admin profile logon, but won't work for a user profile. I changed one of the admin logons to a user logon, and again the utility quit working.

Yup, that is a problem.. and changing the logon profile will not change NTFS security permissions..

>Another serious issue: I can't prevent others from accessing the computer management utility or system utilities from the user logons. If I remove the admin utilities from the Documents and Settings for "All Users" (which can't be deleted, either!), then even the admin accounts can't access these areas. If they can be accessed, anyone can see all the account names and then only need a password cracker program to take control (which I know are available, but not sure how long a password they can crack). Of course, if they are already IN there....
If anyone can help, I am desperate! (Don't tell me to get a proxy. Can't afford it.)

Sounds like your server is already a skew... at the very minimum re-establish basic security for your server and re-think what you are trying to do 'end result'.

http://is-it-true.org/nt/nt2000/atips/atips74.shtml

http://support.microsoft.com/?kbid=308193

good luck,

~Rick

 

[Davetoo]

Rick provides very good information on how you should approach fixing the problem you've run into.

 

[whythis]

Excuse me, Rick's answer looks like a lot of ballooey. Did I miss any practical applications there? Let's see: he says changing the logon profile will not change security...DUH. THAT HELPS! ...reestablish security procedures ....has NOTHING to do with the question, and anyway that's been taken care of. ...Setup your web server iaw established M$ procedures they wrote it...LOTS OF HELP THERE, and if you haven't done so already (providing what Rick said makes any sense to you), your web pages wouldn't have been serving any way. This is ballooey.
Perhaps the questions were not clear? Question 1: How to get programs to run (a recursion utility) from a user account. I tried setting special permissions; didn't work.
Second question: How to prevent anyone hacking into a user account from accessing administrative tools/computer management/users and groups and reading all the account names; perhaps preventing a user account from access through "My Computer" or the "Start Menu" options? If anyone knows, please clue me in on how to do this.
Rick's answer is geared totally to "looking good" and tells one nothing. I don't need platitudes. We need FACTS and METHODS geared toward actual accomplishment. If all you want to do is promote yourself, go elsewhere. I'm not impressed, nor do I come here to impress anyone or be impressed. I come here to help and be helped, and if I answer someone, there will be a practical application in my answer, or I don't answer and waste their time.
For that matter, Lander, do you know how to read? Go back and reread the questions and Rick's answer and then tell me how he gave me a method(s) to solve these issues. whythisagainwhythisagainwhythisagain

 

[whythis]

Excuse me, Rick's answer looks like a lot of ballooey. Did I miss any practical applications there? Let's see: he says changing the logon profile will not change security...DUH. THAT HELPS! ...reestablish security procedures ....has NOTHING to do with the question, and anyway that's been taken care of. ...Setup your web server iaw established M$ procedures they wrote it...LOTS OF HELP THERE, and if you haven't done so already (providing what Rick said makes any sense to you), your web pages wouldn't have been serving any way. This is ballooey.
Perhaps the questions were not clear? Question 1: How to get programs to run (a recursion utility) from a user account. I tried setting special permissions; didn't work.
Second question: How to prevent anyone hacking into a user account from accessing administrative tools/computer management/users and groups and reading all the account names; perhaps preventing a user account from access through "My Computer" or the "Start Menu" options? If anyone knows, please clue me in on how to do this.
Rick's answer is geared totally to "looking good" and tells one nothing. I don't need platitudes. We need FACTS and METHODS geared toward actual accomplishment. If all you want to do is promote yourself, go elsewhere. I'm not impressed, nor do I come here to impress anyone or be impressed. I come here to help and be helped, and if I answer someone, there will be a practical application in my answer, or I don't answer and waste their time.
For that matter, Lander, do you know how to read? Go back and reread the questions and Rick's answer and then tell me how he gave me a method(s) to solve these issues. whythisagainwhythisagainwhythisagain

 

[SkyHawkTech]

Well it's quite simple. You've stated that your server has been 'done in' by hackers. << CLUE HERE. If your server has been compromised then, IMHO, you should completely wipe the hard drive(s), via fdisk, re-install your os and apply all patches.

My suggested 'fix' for your problem might be a little to hard for new admins to understand. The reasoning is quite obvious.. prior compromised access via hacker activity. It is not in the scope of this forum, FWIW, To train people how to sucessfully implement a w2k server.

If you do a simple search via

http://www.google.com

for w2k installation you'll find a lot of examples. The best way would be to RTFM or consult resources via microsoft.com

Cheers,

~Rick