Is it a stupid idea(security wise) to ENABLE and password protect Administrator account, and then remove your own account from Administrator's group and add it to Users group, then turn up UAC to the max? Should Guest account be password protected too, even though it's disabled?
It's up to you to decide if it is stupid.
>>55327437
No it's not, it is similar to DAC policies. I wouldn't add a Guest account, unless I have a shitton of users. But even in that case, having a shitload of users on the same machine is not something that happens often in real life.
>TL;DR no it isn't, but do disable the guest account.
>>55327928
>it is similar to DAC policies implemented in *nix (Linux, Mac, BSD)
>>55327437
doesn't matter
all processes start with system privs and with a bit of fuckery you can bypass the mechanism to drop privs
this is what people mean when they say windows sucks
>>55327928
>DAC
Yes, I noticed Linux had this root account but they usually force you to make your own and then you have to use sudo with your account to do anything. I think this Windows user set up is kind of the same thing. But better remove Guest account entirely. No one uses it.
>>55328163
Lets see a PoC on an up to date 6.1 or greater kernel.
Its not as easy as it used to be.
>>55328381
But a white or Asian could do it easily.
>>55327437
>Should Guest account be password protected too, even though it's disabled?
Just delete it.
>>55328451
Tried it. Can't delete built-in accounts.
