That would work, but the reality is that the vendor has an enterprise
version of GoToMyPc running on the server. They already keep track
of separate passwords for 100's of servers across the country. I am
probably one of the few customers to implement a screen-saver
password as a means to control access to a common area server. My
original question was to find out if I was missing something (how to
let a trusted co-worker close the password protected screen-saver
without giving them the administrator password).
I appreciate the many responses...so far, there does not appear to
be an easy way to do what I want (I wish Microsoft would add an
enhancement, though). I don't think I should have to give up the
domain administrator password just to close a password protected
screen-saver.
Tom Milliner, CPA, MCSE
Director of Network Services
MetroTex Assc of Realtors
8201 N. Stemmons Frwy
Dallas, TX 75247
www.dfwrealtors.com
mail to: tomm@dfwrealtors.com
(214) 540-2741
-----Original Message-----
From: Greg Kelley [mailto:gkelley@vestigeltd.com]
Sent: Wednesday, February 09, 2005 12:03 PM
To: tom.milliner@verizon.net; focus-ms@securityfocus.com
Subject: RE: Password Protected Screen Saver and Administrative Password
Why not provide a Domain Admin account to your vendor that they can use.
Setup security auditing so you know exactly when they come in and when
they leave and what they do. Make sure they provide you information on
when they plan to do maintenance so you can compare that with your
security logs. Make sure they also let you know when they have an
employee who serviced your account leave so you can change the pwd on
the account.
Set the account to change pwd every 30 days, remember atleast 10
passwords and set account lockout. Don't put a time on the lockout,
make them notify you it is locked and ask you to unlock it.
Greg Kelley, EnCE
Vestige, Ltd
46 Public Square, Ste 220
Medina, OH 44256
(330)721-1205 x5432
(330)721-1206 Fax
http://www.vestigeltd.com
-----Original Message-----
From: Tom Milliner [mailto:tom.milliner@verizon.net]
Sent: Tuesday, February 08, 2005 9:11 PM
To: 'Patton Roub'; focus-ms@securityfocus.com
Subject: RE: Password Protected Screen Saver and Administrative Password
The vendor has a lot of customers and routinely uses
GoToMyPC for support. In an ideal world for the vendor,
there would be no password protected screen-saver to
deal with. In other words, they could log on as needed (different time
zones) to do maintenance. The screen- saver actually is a disruption to
them, but since the server is in a common area, I use it. I also use it
so that I can keep track of the vendor's maintenance (if something
breaks after they log on, then I may want to call them)...they have to
ask us to unlock the screen-saver.
When I am not there, a trusted co-worker needs to be
able to unlock the screen-saver.
I am not understanding the suggestions to make the
trusted co-worker a local administrator. Since the
server is a domain member server, I logon as the
domain administrator. Then it goes to password
protected screen-saver after 60 minutes of inactivity.
I know it needs an administrator's password to unlock
the screen-saver. I have assumed that meant my domain administrator
password instead of a local administrator password. I will test this
tomorrow at work.
Tom Milliner, CPA, MCSE
2404 Summer Place Dr.
Irving, TX 75062
(214) 540-2741
tom.milliner@verizon.net
-----Original Message-----
From: Patton Roub [mailto:proub@state.wy.us]
Sent: Tuesday, February 08, 2005 6:22 PM
To: focus-ms@securityfocus.com; tom.milliner@verizon.net
Subject: Re: Password Protected Screen Saver and Administrative Password
Is this a Windows 2000 Server or Windows Server 2003? If it is, then
you should consider terminal services in maintenance mode. It requires
no additional license purchases (two are free) and your vendor can
connect without going through a fourth
party's server equipment (GoToMyPC)(trusted?/untrusted?)
to get there. They would log in as themselves (event logging
good) and their access rights can be controlled. In terminal
services, they also would not see your screen saver as they
would have their own session/desktop/etc.
Patton Roub, BSEE, MCSE
proub@state.wy.us
"Tom Milliner" <tom.milliner@verizon.net> 2/7/2005 8:07:04 PM >>>
Does someone know a way to allow a normal user to
release a server password protected screen-saver
without giving the user the administrator password?
I need this so that third-party support can access
our server via GoToMyPC when I am not there. The
password protected screen-saver blocks them from
remote access to fix problems. I cannot always be
on-site to assist by supplying the screen-saver
password.
Tom Milliner, CPA, MCSE
tom.milliner@verizon.net
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
