Windows 2000 Scheduled Jobs

After reading about Windows 2000 scheduled jobs on Peter's blog. I also wanted to state something about this.

We use scheduled jobs on Windows 2000 Server at approximately 150 customer servers. Sometimes customers change their administrator passwords, but forget or don't know about the scheduled jobs. Luckily we don't run backups from the scheduled jobs. We only use them for anti-virus updates, to check if all services are running etc...

Still it's a pain in the ass if we get complaints about servers getting infected with viruses or if some service doesn't work because the service checker didn't run.

Also the point that Peter makes is very valid. Where does Windows save these passwords ? If they are stored somewhere they hell can be recovered. Even if it's only a password hash.

They (the hashes) are supposedly in the registry (HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users), although you can’t see it ?
In Windows 2000 they life in c:\winnt\system32\sam I think…
Maybe this is what you are looking for (an offshoot of the Samba-project):
http://public.www.planetmirror.com/pub/s.. or http://ftp.azc.uam.mx/mirrors/samba/pwdu..

Lennie () - 07 March '04 - 13:57

Interesting, something to test tomorrow at work. As each valid user that can login on the Windows 2000 machine can create scheduled jobs there may be a way to elevate privileges.
I’ll keep everyone posted :)

Cliff () (URL) - 07 March '04 - 14:04

Recover sam password hashes..
i have a nice tool here for that
outputs a nice list of usernames and hashes.. that logged in locally on that computer (if thats what your trying to get at)

iKriz (URL) - 07 March '04 - 23:48

No, This is about recovering passwords used for Scheduled Jobs on Windows 2000 and trying to use these hashes to elevate privileges on Scheduled Jobs made by ordinary mortals on the Win2K machine.

Cliff () (URL) - 08 March '04 - 09:23


Name:  
Remember personal info?

Email:
URL:
Comment:Emoticons / Textile

  ( Register your username / Log in )

Notify: Yes, send me email when someone replies.  

Small print: All html tags except <b> and <i> will be removed from your comment. You can make links by just typing the url or mail-address.