Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 244
  • Last Modified:

Why did this sysadmin use Reversible Encryption?

I've just taken over support on a small Windows server from a prior sysadmin who the Director no longer trusted.  I've looked at the network setup, and notice that the Director's User account is the ONLY account on the network set with "Reversible Encryption".   She does nothing beyond ordinary Office applications, and sometimes uses Remote Web Workspace to connect from home.

Why might he have set this, and what might he have been up to?  If he was snooping, he would have wanted to do it from home, but I'm not sure what benefit there would have been to this setting, when he could already remote in with Admin rights.  The only thing he might have wanted to do which isn't as easy just logging in as admin was to follow her email... so perhaps he wanted to log on as her to snoop that way?  if so, could this have helped?

He was definitely antagonistic towards her - I knew him!


0
jennynover
Asked:
jennynover
  • 3
  • 2
1 Solution
 
Dave HoweCommented:
The main use of reversible encryption is to decrypt the password of a user who frequently forgets it - however, it is more likely that in this case the former admin was interested in the password not to log into that system (which could be done easily) but for either or both of

1) access to EFS encrypted files that lack a recovery agent

2) access to other systems (like webmail) as most users use the same password for all their systems.

given he could just have set a recovery agent though, its much more likely to be the latter.
0
 
jennynoverAuthor Commented:
Thanks. ... and how do you decrypt the password?
0
 
jennynoverAuthor Commented:
... and is there anything else I should be looking out for to lock down the server (extra points!).  I've closed all ports at the router, except those needed for RWW...   Or any other security holes he might have left I should look out for on the server (I notice that he downloaded TSWeb and saw logon type 8 records from before he left - which may be related).
0
Cyber Threats to Small Businesses (Part 2)

The evolving cybersecurity landscape presents SMBs with a host of new threats to their clients, their data, and their bottom line. In part 2 of this blog series, learn three quick processes Webroot’s CISO, Gary Hayslip, recommends to help small businesses beat modern threats.

 
Dave HoweCommented:
I think the "cain" tool from cain and able can do it - admittedly though, I have never tried.
0
 
jennynoverAuthor Commented:
Thanks Cocobill also for the links, not specific to the Q; but useful information.  Will go through.
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now