What is the best way to prevent users from switching to the System account using Task Scheduler? I need a precise method; I don't want to disable the Task Scheduler. Switching to the System account allows an attacker to accomplish things normally prevented in his or her regular policies in their own account. Such as changing the computer's date and time, debugging programs, etc. I have known of this bug for quite some time, ever since Windows 2000 came out. And the vulnerability still exists on Windows XP Home Edition, Version 2002, SP2 (the one I am using). Does this vulnerability still exist on Windows XP Professional? Here are the steps for the attack:
1) Start / Run cmd
2) If the time is 11:23 a.m., then enter "at 11:24am /interactive taskmgr.exe" without the quotes.
3) When Task Manager launches less than a minute later End Task explorer.exe under Processes. The desktop will disappear, but Task Manager will remain.
4) Wait one full minute for the system to adjust itself (things happening in the background). This may or may not be necessary. It is on my computer. You'll know you're good to go when you can access the pull-down menus in Task Manager again.
5) Under File in Task Manager choose New Task (Run...) and type "explorer" (without the quotes). And click OK.
6) You should see the green rolling hills of the default Windows XP desktop, and if you click on the Start button you'll see System at the top.
7) You are now logged in as God... I mean System. You can now view the SAM data in the registry, view the Protected Storage data in the registry and jump up and down with mischievous joy!
Any solution should allow for two things:
1) The fix must restrict Administrators, which is what a great many users are.
2) The fix must not require disabling the Task Scheduler.
3) It preferably would be the same fix for Windows XP Home and Windows XP Professional (if this is still an issue on Windows XP Professional)
If someone can test this (it'll only take a minute and doesn't crash your computer or anything) on Windows XP Professional and let me know I'd appreciate it too.
