I need some expert help in closing a security hole I have come across with Windows XP. Couple of months back, I saw a guy 'work' his way around the security of Windows XP Pro. Whilst at a workstation logged in under a limited user account the guy called up the command prompt, entered a command to start an .exe file on a timer. What he then did was setup explorer.exe to start within, say, 1 minute. He then did a ctrl+alt+del and under the processes tab ended explorer.exe What this did was in effect kick him out of his current session as he had in effect shutdown Windows, only a blue screen was displayed - no login screen or anything. but 1 minute later, the command kicked in and Windows restarted. When Windows re-started he was then "logged" in as an admin. There were no permissions or restrictions on anything. Does anybody know where i can find the syntax for the command prompt so i can see exactly what is happening and then try to disable this workaround. Obviously, since somebody has to login under a limited username/password first, before switching, it would be easy to determine the last user if any damage was done - however, I have no idea if it could be proven that said user performed the above 'cheat' and therefor caused the damage. Thanks for your help with this. D.

Good luck.

Cool trick but I think you missed observing something. To schedule something you would use the AT command like AT \\machinename time /interactive "explorer.exe" But a "user" can't run the command. They get access denied. What you describe works under power user or admin status. Though I have as yet to verify what the rights status is since I was in as an admin when I did the procedure you describe and didn't see any differnece after the procedure. Give a person a fish, they eat for a day. Suggest they internet search and they learn a skill for a lifetime.