Hello Fred, In case you didn't know already, you might check
this out.
http://www.briansbuzz.com/w/030213/ --- Tony Wolfs
---
XP passwords rendered useless, By Brian Livingston
Windows XP, which has been marketed by Microsoft as "the most
secure version ever," has been found to have a flaw so bone-
headed that it renders passwords ineffective as a means of
keeping people out of your PC.
...Anyone with a Windows 2000 CD can boot up a Windows XP box
and start the Windows 2000 Recovery Console, a troubleshooting
program. Windows XP then allows the visitor to operate as
Administrator without a password, even if the Administrator
account has a strong password. The visitor can also operate in
any of the other user accounts that may be present on the XP
machine, even if those accounts have passwords. Unbelievably,
the visitor can copy files from the hard disk to a floppy disk
or other removable media - something even an Administrator is
normally prevented from doing when using the Recovery
Console....
Lots more via the above link.
Later in the same article, Brian correctly points out that this exploit
requires physical access to a PC; and that if a hacker has physical
access to your PC, then they can eventually break in, if they're good.
But this "use the W2K CD" trick makes breaking in trivially fast and
easy, and it shouldn't be that way: It's a major gaff. Someone's head
should be on a post over at Microsoft, for this.
BTW, "Brain's Buzz" is a new publication. You may recognize Brian
Livingston's name from any of his many authoritative books on Windows
(see
http://www.tinyurl.com/615r ), from his long-running InfoWorld
columns, or from his speaking at trade shows and in the media: He's
very, very good at what he does.
Along with Brian's Buzz, he's also created a specialized search engine
for researching Windows problems. With one "WinFind" search, you can
simultaneously comb the web sites of Annoyances.org, JSI, Inc., the
Langa List (Standard Edition), Lockergnome, PCWorld.com, Tom's
Hardware, Windows 2000FAQ, Windows Web Solutions, WinInformant,
WinNetMag, WinSupersite, Woody's Watch, and several of Brian's own
resources.
WinFind's full search is available at
http://www.briansbuzz.com/search/,
and the simple search is on the front page at
http://www.briansbuzz.com/
.. Both WinFind and the Brian's Buzz newsletter are free. Check 'em out!