Solved

Why did this sysadmin use Reversible Encryption?

Posted on 2009-07-14
6
238 Views
Last Modified: 2013-12-04
I've just taken over support on a small Windows server from a prior sysadmin who the Director no longer trusted.  I've looked at the network setup, and notice that the Director's User account is the ONLY account on the network set with "Reversible Encryption".   She does nothing beyond ordinary Office applications, and sometimes uses Remote Web Workspace to connect from home.

Why might he have set this, and what might he have been up to?  If he was snooping, he would have wanted to do it from home, but I'm not sure what benefit there would have been to this setting, when he could already remote in with Admin rights.  The only thing he might have wanted to do which isn't as easy just logging in as admin was to follow her email... so perhaps he wanted to log on as her to snoop that way?  if so, could this have helped?

He was definitely antagonistic towards her - I knew him!


0
Comment
Question by:jennynover
  • 3
  • 2
6 Comments
 
LVL 33

Accepted Solution

by:
Dave Howe earned 120 total points
ID: 24851803
The main use of reversible encryption is to decrypt the password of a user who frequently forgets it - however, it is more likely that in this case the former admin was interested in the password not to log into that system (which could be done easily) but for either or both of

1) access to EFS encrypted files that lack a recovery agent

2) access to other systems (like webmail) as most users use the same password for all their systems.

given he could just have set a recovery agent though, its much more likely to be the latter.
0
 
LVL 4

Author Comment

by:jennynover
ID: 24852733
Thanks. ... and how do you decrypt the password?
0
 
LVL 4

Author Comment

by:jennynover
ID: 24853176
... and is there anything else I should be looking out for to lock down the server (extra points!).  I've closed all ports at the router, except those needed for RWW...   Or any other security holes he might have left I should look out for on the server (I notice that he downloaded TSWeb and saw logon type 8 records from before he left - which may be related).
0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 
LVL 19

Expert Comment

by:CoccoBill
ID: 24859632
0
 
LVL 33

Expert Comment

by:Dave Howe
ID: 24861253
I think the "cain" tool from cain and able can do it - admittedly though, I have never tried.
0
 
LVL 4

Author Comment

by:jennynover
ID: 24862794
Thanks Cocobill also for the links, not specific to the Q; but useful information.  Will go through.
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
One of the biggest threats facing all high-value targets are APT's.  These threats include sophisticated tactics that "often starts with mapping human organization and collecting intelligence on employees, who are nowadays a weaker link than network…
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question