For Administrators How to deny access from accessing file system using various means?

[JashUpadhyay]

Hi Team,

1. My concern here is for RDP we do have two factor enabled. But if the user do access the path via ... \\SERVERXXX\C$ , then are there any means that we can enable two-factor for them? 
2. Also an administrator can invoke these below from his desktop with Run As Administrator mode providing the Domain Administrator credentials to access the Domain services like          - Services.msc - to shutdown and start any server services

        - DSA.msc - to add delete users , computers in Windows AD
        - DNSMGMT.msc - DNS Management
        - DHCPMGMT.msc - DHCP Management
        - GPMC.msc - group policy editing
        - Web console based tools on SCCM management 

Can we protect this with two FA?

Regards

Jash Upadhyay

[LukaKodric]

I'd like to know that too!

[JashUpadhyay]

Hi Team, 

I still have not got any response on this? kindly update on the query posted.

[JayGuillette · Accepted solution]

Access to \\SERVERXXX\C$ is not something that Authentication Manager protects, our Windows agent protects Credential Providers which run at the console or remote console. Maybe you could ask RSA Sales about an RFE, Request for Enhancement to protect \\SERVERXXX\C$, but I thought that was considered a security backdoor.

As to Run As or Run As Administrator, the later versions of the RSA Windows agent, 7.3.3, challenge Run As the same as RDP, in other words if a user would be challenged for access to the console, they would be challenged in order to do Run As Administrator.  you might need to set Access Control on these files or executables to Administrators, and set RSA agent Challenge to everyone or to all Administrators

[JashUpadhyay]

Hi Jay,

I tried with the latest agent and checked it, it is not working for Run as Administrator( Challenge part). Settings for the agent I have kept ( Challenge All Users )

[JayGuillette]

You'd have to look at the agent logs to determine what happens during what should be a challenged 'run as Admin'.

Use the RSA Control Center to set verbose logging.

There are many logs; some for Credential Providers and challenge settings, some for Offline Days (DA = Disconnected Authentication).  Note time Run As Challenge failed, look at logs, if you note a symptom do a search here in RSA Link or open a support case for help.