Pourquoi devriez-vous désactiver la connexion réseau pour les comptes locaux ?

[visiteur]

This question is in reference to @SwiftOnSecurity’s Twitter thread: https://twitter.com/SwiftOnSecurity/status/655208224572882944

After reading through the thread, I still don’t quite get why you would want to disable network login for local accounts.

So here is what I’m thinking, please correct me where I am wrong:

Say I have an AD set up with a DC and multiple clients. One of the clients is John. So in the morning, John goes into work, and logs into his desktop PC with the AD credentials. At noon, John heads out for a meeting, and ‘locks’ his computer (windows + L). He then needs to connect to his PC back at the office using his personal laptop remotely (via RDP or something). However, using this new policy, he won’t be able to do so.

The explanation that Securitay gives is that the passwords are not salted. However, how would an attacker gain access in this case? On which end is the password not salted? Or is the situation I have in my mind completely unrelated to what she is trying to say? If this is the case, what is she actually trying to say?

[admin]

Allowing network logon for local accounts is dangerous and a poor security practice. For administrators group members, I would actually characterize it as negligence. It enables lateral movement, and is difficult to detect and audit due to the account logons are not logged centrally (on the domain controllers).

To mitigate this threat, Microsoft actually created two new builtin security identifiers to add to the “Deny access to this computer from the network” user right:

S-1-5-113: NT AUTHORITY\Local account  
S-1-5-114: NT AUTHORITY\Local account and member of Administrators group  

http://blogs.technet.com/b/secguide/archive/2014/09/02/blocking-remote-use-of-local-accounts.aspx

http://blogs.technet.com/b/srd/archive/2014/06/05/an-overview-of-kb2871997.aspx