invictus's questions

We have a IIS server with multiple sites that are managed by different teams. We want to standardize on and enforce Kerberos autentication for all sites with each site having an individual AD group for authorization/access.

The obvious solution would be to just configure authentication and authorization in each sites web.config, but since we do want each team to be able to manage their own site we assume that the authentication/authorization configuration then can be changed/overriden. We do not want the authentication/authorization changed or disabled, but we do want each site team to be able to provide a custom authentication error page.

Is it possible to have individual authentication/authorization config for each site that cannot be overriden by developers with web.config further down the hierarchy, while still allowing the custom authentication error page to be overridden?

If you have a Chrome Extension (i.e. IETab) that requires a lot of permissions for all sites you visit (such as "tabs", "webRequest" and "webNavigation"). Is it possible with GPO or registry settings to restrict which sites this extension is allowed to have these permissions and thus overriding the Manifest?

I have noted that there is an ExtensionSettings GPO with an "runtime_block_hosts" key, however, it does not seem to actually remove the extensions permissions as expected when the extension itself requests the permissions for all sites in its manifest.

In Unix and Linux based system you usually run services in context of service accounts that have no password set and cannot be logged on. As far as I have understood, the processes are spawned from a higher privileged process and switched to the service account using setuid.

Is the same possible on Windows based systems, or do you always have to set a password for service accounts?

In an enterprise environment, you usually have several locked down Windows servers (either Windows servers/Terminal server directly, or through Citrix) where the user is logged in directly into a full window application.

There are several escape techniques from such environments, but when you have an open/save dialog, is there any way to restrict the users ability to access \127.0.0.1\c$ from such System dialogs?

I am using VbScript for retrieving the securitydescriptor of a Win32_Service. I am using the following code:

SE_DACL_PRESENT = &h4
 ACCESS_ALLOWED_ACE_TYPE = &h0
 ACCESS_DENIED_ACE_TYPE  = &h1

 strComputer = "."
 Set objWMIService = GetObject("winmgmts:" _
  & "{impersonationLevel=impersonate, (Security)}!\\" & strComputer & "\root\cimv2")

 Set colInstalledPrinters =  objWMIService.ExecQuery _
  ("Select * from Win32_Service")

 For Each objPrinter in colInstalledPrinters
    Wscript.Echo "Name: " & objPrinter.Name 
 ' Get security descriptor for printer
  Return = objPrinter.GetSecurityDescriptor( objSD )
  If ( return <> 0 ) Then
  WScript.Echo "Could not get security descriptor: " & Return
  wscript.Quit Return
  End If
 ' Extract the security descriptor flags
  intControlFlags = objSD.ControlFlags
  If intControlFlags AND SE_DACL_PRESENT Then
 ' Get the ACE entries from security descriptor
   colACEs = objSD.DACL
  For Each objACE in colACEs
 ' Get all the trustees and determine which have access to printer
   WScript.Echo objACE.Trustee.Domain & "\" & objACE.Trustee.Name
   If objACE.AceType = ACCESS_ALLOWED_ACE_TYPE Then
    WScript.Echo vbTab & "User has access to printer"
   ElseIf objACE.AceType = ACCESS_DENIED_ACE_TYPE Then
    WScript.Echo vbTab & "User does not have access to the printer"
   End If
  Next
  Else
  WScript.Echo "No DACL found in security descriptor"
 End If
 Next

However, every time I run it I get the message saying the resulting code is -2147023582 something, rather than the error codes defined in the manual.

Anyone got any ideas? I am using Windows 7 professional 64-bit.

Update: The number is -2147023582. Could it be some sort of 64-bit issue? doesn't that look like a unsigned integer stored as a signed integer?