Windows XP Security Concerns

Got this from me101 who didn't have time to post, fortunately I do ;)

The following problems listed below apply to Windows XP Professional in a Workgroup for more details and further information click the link below.

1. Problem with account locking due to fast user switching

Fast user switching is a new Windows XP feature, which allows simultaneous logging on of more than one user. It is based on Terminal Services technology and runs unique user sessions that enable each user's data to be entirely separated. Fast User Switching is enabled by default on a stand-alone or workgroup-connected computer. It is not available in domains.

2. Problem with reset password disk

Windows XP introduced a new feature - "Password Reset Disk", which can be used to recover user account and personalized computer settings if a user forgets his password.

The problem is that in certain conditions (Minimum password age 0) user may not be able to reset his password using above mentioned disk and the only solution is the reset password feature available to the Administrator. First, make sure the "Minimum password age" policy is set to a value other than zero. Now, supposing the user forgets his password before its age expires, he will not be able to reset it with the disk until the password expires.

3. Remote Desktop sends recently used username in plaintext

Remote Desktop client remembers account name that has been used recently to establish RD session with another machine. When sniffing the network, it was discovered that RD client has send login to the other computer in plain text. It was further clarified that what was actually sent is not a user account name on the destination machine, but username which has been used recently to logon with RD client.

However, assuming that the logon is made to the same computer as recently, RD client sends in clear text user account name present on the destination computer. In some cases, this can pose a big security risk. For example, if RD client is used by users connecting to a terminal server, the attacker can sniff all the TS user accounts.

News source: Beyond-Security's SecuriTeam.com