Sounds like a nightmare if, say, your network has a wireless LAN attached to it
and you are relying on MAC as an access control. Which is not an unusual
situation at all these days.

"Laura A. Robinson" wrote:

> How are the passwords being stored in the domain? Is reversible encryption
> being used?
>
> Laura
> ----- Original Message -----
> From: "paul Carcary" <PaulLacewood.co.uk>
> To: <focus-mssecurityfocus.com>
> Sent: Wednesday, December 19, 2001 10:44 AM
> Subject: mac client password changes
>
> > Hi
> >
> > I remember a recent odd posting regarding renaming 2000 user accounts and
> > then being able to log in using either name
> >
> > I found another oddity, this time with passwords.....
> >
> > Running 2000 Active Directory with mixed 2000 Pro and MAC clients,
> password
> > expiry is enforced.
> >
> > When a 2000 client changes the password all works exactly as expected
> > When a MAC client changes the password all appears to work as expected,
> > except that the client can then use either the old or the new password to
> > login
> >
> > This "dual password" works from either a MAC or 2000 client, (if a 2000
> > client changes a password you only get one password)
> >
> > Anyone seen this ?
> >
> > There is only one domain controller for this domain.
> >
> > Any thoughts ?
> >
> > Regards
> >
> > Paul Carcary
> >
> > MCSE-W2K, CNE5, CNE4, ASE, CSE, CCNA, CCDA
> >

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]