Re: [Full-disclosure] Windows XP Home LSA secrets storesXPloginpassphrase in plain text

["Mike N" <niceman@xxxxxxx>]

The administrator account in Windows does not automatically hold all EFS keys.  
It fully depends on how EFS was configured for the machine.  A secondary EFS 
recovery account is *often* assigned to the domain administrator, or an 
administrator account, but it's quite possible to allow only the assigned 
account access to EFS files with no secondary EFS recovery account.  For that 
case adminstrator access is useless for accessing EFS files. 

  ----- Original Message ----- 
  From: John Doe 


  As what comes to EFS, once you get hold of the administrator 
  account, you can decrypt the EFS for _all_ users on the computer. It doesn't
  matter how you acquired the password.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/