tag:blogger.com,1999:blog-9537945.post1414988966425553133..comments2008-06-27T07:23:39.923-05:00Christopher Painterhttp://www.blogger.com/profile/12167478740431444267chrpai@yahoo.comBlogger3125tag:blogger.com,1999:blog-9537945.post-31743207530647862752008-06-27T06:48:00.000-05:002008-06-27T06:48:00.000-05:00For Link Exchange <BR/><BR/>As your blog and my blog as same theme. I would like to share link with your blog. this will help to improve our rank in search engine.<BR/>my link detail <BR/>Title : vista guide<BR/>URL :- http://vista-basic.blogspot.com/laptophttp://www.blogger.com/profile/09610487672010327525noreply@blogger.comtag:blogger.com,1999:blog-9537945.post-42579386270955501412006-10-19T14:10:00.000-05:002006-10-19T14:10:00.000-05:00Some Microsoft analysis has been posted at <a href="http://blogs.msdn.com/vistacompatteam/archive/2006/10/19/impact-of-least-privilege-in-system-services.aspx">Impact of Least Privilege in System Services</a>Windows Installer Teamhttp://blogs.msdn.com/windows_installer_teamnoreply@blogger.comtag:blogger.com,1999:blog-9537945.post-91892308043024185212006-10-18T15:44:00.000-05:002006-10-18T15:44:00.000-05:00I did some research and these are the rights that were revoked in MSI 4.0.<br /><br />http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/authorization_constants.asp<br /><br />SE_BACKUP_NAME<br /><br />Required to perform backup operations. This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file. Any access request other than read is still evaluated with the ACL. This privilege is required by the RegSaveKey and RegSaveKeyExfunctions. The following access rights are granted if this privilege is held:<br /><br />SE_CREATE_TOKEN_NAME<br />Required to create a primary token. <br /><br />SE_DEBUG_NAME<br />Required to debug and adjust the memory of a process owned by another account.<br /><br />SE_ENABLE_DELEGATION_NAME<br />Required to mark user and computer accounts as trusted for delegation.<br /><br />SE_MACHINE_ACCOUNT_NAME<br />Required to create a computer account. <br /><br />SE_MANAGE_VOLUME_NAME<br />Required to enable volume management privileges.<br /><br />SE_SECURITY_NAME<br />Required to perform a number of security-related functions, such as controlling and viewing audit messages. This privilege identifies its holder as a security operator. <br /><br />SE_SYNC_AGENT_NAME<br />Required for a domain controller to use the LDAP directory synchronization services. This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers. <br /><br />SE_SYSTEM_ENVIRONMENT_NAME<br />Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. <br /><br />SE_SYSTEM_PROFILE_NAME<br />Required to gather profiling information for the entire system. <br /><br />SE_SYSTEMTIME_NAME<br />Required to modify the system time. <br /><br />SE_UNDOCK_NAME<br />Required to undock a laptop.<br /><br />SE_UNSOLICITED_INPUT_NAME<br />Required to read unsolicited input from a terminal device.Christopher Painterhttp://www.blogger.com/profile/12167478740431444267noreply@blogger.com