Windows 2K Restarting...

Undeadlord · February 13th, 2003, 04:29 PM

Hey all,

Here is the deal, we have some jokester in the office who has figured out a way to remotely re-start Windows 2000 machines. Does anyone know what software or "scripts" can do this? I really need to figure it out. Is there a port I can block on the internal network. Any help would really be appreciated. Thanks!

Undeadlord

**EvilRick** · February 13th, 2003, 04:44 PM

Make sure the "jokester" hasn't made a 'Scheduled Task' that restarts it.

DVNT1 · February 13th, 2003, 04:49 PM

There seem to be many apps that do this, like from the command line, you use the Shutdown.exe utility, which is located in the Windows 2000 Resource Kit. Or the Computer Management method (Right-click the Computer Management (Local) node and select Connect To Another Computer. On the dialog that appears, specify the remote computer and click OK. After the console connects to the remote computer, right-click the Computer Management (computername) and select Properties.
Go to the Advanced tab and click the Startup And Recovery button. On the dialog that appears, click Shut Down.
Another dialog will appear that will provide you with several options like logoff, restart, and shutdown. Select the choice you want and click OK.)

I though you have to be a power user or administrator level user to remotely restart the computer. I never really checked though.

Undeadlord · February 13th, 2003, 04:55 PM

Rick .. I did check that .. unfortunetly, this seems to be a remote issue. I wonder if there is anyway I can scan for this, I think I know who is doing this, but not entirely sure.

Undeadlord

**EvilRick** · February 13th, 2003, 04:56 PM

Isn't there a "net..." command that can be used?

Love2Learn · February 13th, 2003, 04:58 PM

their is a prog that hides itself called appstracka that i have had to rid of before. some of the same issues. try www.webattack.com they have plenty of progs that might help ya rid of your prankster.

-L2L

Undeadlord · February 13th, 2003, 05:03 PM

Evilrick ... yea thats what I was thinking .. we had a rash of those "net send" a while ago. I was thinking there might be a net shutdown command or something.

Thanks L2L I will check it out.

Undeadlord

implexant · February 13th, 2003, 07:44 PM

well like DVNT1 said I would think you'd have to have some kind of administrative privelege to be able to remotely restart or shutdown a computer. if all else fails, check your local security policy to see if there is something in there that addresses it.

-Chris

implexant · February 13th, 2003, 07:48 PM

on a second thought I just found this, from here: http://www.der-keiler.de/Mailing-Lis...2-09/0058.html

Quote:

if u do not want a specific computer to be able to go for a remote shutdown then i think that this shud work:goto: usermanager-->policies-->user rights-->force shutdown from remote system (DISABLE THIS)

try that and let us know what happens.

-Chris

implexant · February 16th, 2003, 06:08 PM

any news on if this works or not? or do you hava wait till monday?

-Chris