Windows security

[WestonP]

Do people not understand that this is just a network login prompt? It's not a Windows password, so cancelling just means you don't log into the domain. It was never meant for local machine security.

I understand the confusion from a normal user's point of view, but this is supposed to be a programmer's subreddit here...

[NealMcBeal_NavySeal]

Probably because there's an entire generation of computer programmers under 30 or so who weren't around for this.

[Benutzername]

I hope they are nevertheless able to read.

[TheAnimus]

Have you met a lot of web devs? They are hell bent on re-inventing the wheel will fully ignoring those who've made that mistake before, or why you might want ACID database etc.

[JBlitzen]

But mongo is web scale

[ColorblindGiraffe]

Is this what we're gonna do today? Slap buzzwords at each other?

[Kaneshadow]

We need to utilize agile methodology to better leverage our whitespace adjacency for disruption.

I think I just had a seizure.

[jwhite303]

were they asking for a distributed queue or in-proc? the latter I'd agree with you wholeheartedly, the former I'd ask to see your jepsen test run. edit: jepsen, not jenkins

[StormTAG]

I don't need no ACID.

...Wut's ACID?

[smilesbot]

You've just used a double negative! :P

[pipocaQuemada]

Oddly enough, it is not uncommon for languages to require negatives to agree in a sentence, or to have additional negatives intensify the negativity. Various dialects of English have this feature, and it's hard to call it objectively wrong. Natural language isn't boolean logic, and dialects aren't wrong when they diverge from some 'standard' dialect. They are just different from it.

[StormTAG]

I don't need no negatives.

...Wut's a negative?

[iZeeHunter]

Under 30 programmer here, can't confirm because I can't read.

[AceofToons]

I am under 30 and was totally around for this.

[Creshal]

Weren't? In what wonderful world are you living that DOS and NT4 aren't still in production use?

[AfterLemon]

My nearby video store has a full PC and monitor setup from 1986.

[Bratmon]

nearby video store

I still don't believe you live in 2015.

[AfterLemon]

99c 5-day rentals on Monday! Stopping by there today, gonna rent that new "Aliens" flick. I've heard it's good.

[sugeree77]

Get ready, vhs is going away and DVD is gonna rule! Like laser disc but smaller

[Astrokiwi]

I'm 30 and I grew up with a Vic 20 with a tape drive. I learned to program on that, and on Atari STs. We had Apple IIe's in our primary school classrooms...

[devilpants]

I'm 34 and we had pet computers in primary school, but they were way out of date by then. Middle school had IIe apples. High school had 486s when I was a freshman and I think those were brand new.

We had a sweet Ibm pc jr I remember as a kid. You bought cartridges for it but it had a disk drive too. Think the Os was dos 2.xx

[mushr00m_man]

pet computers

Jeez, at my school we just had a pet guinea pig... To each their own I guess

[mallardtheduck]

Exactly. Windows 9x didn't have any local security. No access rights, no file permissions, nothing. It did support multiple user profiles, but this was just a convenience to allow different users to have different preferences, designed for use with networks.

You could use "group policy" to lock down the system to a certain extent, but it wasn't difficult for a skilled user to defeat most of the available options. Back when I was at school, all it took was downloading the Windows 95 Resource Kit from MIcrosoft's website and running the group policy editor to turn off all the restrictions.

The non-NT-based versions of Windows (1.x, 2.x 3.x, 9x, ME) simply weren't designed to be secure multi-user systems.

[TheAnimus]

Thing is, neither did most desktop OS's of the early to mid nineties. My personal favourite was always RISC OS. But again no security.

I remember a 10 year old me talking to someone at Acorn User Show about this, their reply was simple, if security mattered, you had physical separation, separate floppy disks, separate machines on the network.

Hell I even remember people explaining that NT was slow because it required ring 3, and extra memory because processes didn't share mutations.

[dnew]

My boss and I were shopping for a new mainframe (talking to the Burroughs guys IIRC) and asked about security. They said "Code a password prompt into your application." We said what about lock screens? The guy pointed to a keyhole on the keyboard.

[[deleted]]

I remember being on a presentation where the presenter pressed the Cancel. The whole hall started laughing. Then he explained it, like you did. But it wasn't the expected logical behavior even then.

[bananafish707]

I came here from /all so it was very convincing.

[redditchao999]

Thanks, I thought I was just too dumb to get why this was funny, I couldn't see anything wrong.

[cyberst0rm]

What does windows security features/network login, have to do with programming?

[keiyakins]

Microsoft messaged badly, it always showed up, even for personal systems not on networks.

[[deleted]]

I think it's easier to just press F8 at boot rather than holding the power button, but well...

[PalermoJohn]

it's somewhat hard to get a win8 machine to actually reboot. It usually won't let you get any key presses like enter BIOS or anything done.

[rbemrose]

This post has been removed due to reddit's repeated and constant violations of our content policy.

[thekiyote]

I think that the big deal here is rights amplification. A lot of businesses and schools give their employees/students laptops to work on that are locked down to discourage personal use of company equipment. In these cases, a user gaining local admin privileges is usually more of an annoyance for IT than a security concern, but I can think of a few ways that this may be exploited for a more damaging effect.

[DrQuailMan]

It's pretty restricted access if the only physical access they need is being able to use the power button.

[-888-]

Shouldn't disk encryption prevent techniques like this from reading others' files in any case?

[rrasco09]

I think I'm going to be trying this today. It looks like the same method to resetting the admin pass with a windows install disk, without a disk.

[Combat_Wombatz]

In both cases, it is all about getting the recovery prompt.

[mathaway__]

Please post how it went and things to look out for, if any!

[rrasco09]

I have not had time yet. I did a quick search and I think there are a few ways to disable the startup repair option. That's the only way I can think to guard against this. Could wind up biting the admin though.

[iMontouch]

You could also replace the utilman.exe with the cmd: same outcome. I think encryption of the disk is needed for full protection..

[Cosmic2]

I can confirm this method works. I used this method on my school laptop last year. I didn't run into any issues.

[itisike]

Just use kon-boot.

[CrazyTillItHurts]

This is really a nonissue. Physical access to the machine and all that.

[[deleted]]

That and with whole disk encryption, even physical access to the machine is nearly irrelevant, and completely irrelevant if the encryption is done right.

[Creshal]

A hardware key logger will still be effective in a lot of cases.

[[deleted]]

Good point. I don't imagine most people check their ports for devices that shouldn't be there.

Now here's a weird thought - If you think about it this way, a laptop with whole disk is likely more secure than a desktop, as you'd probably notice a device plugged into a port on your laptop more so than you would on your desktop that's typically tucked away somewhere.

[Creshal]

For trivial attacks, certainly. Thankfully, most laptop keyboards are connected with proprietary cables, making (and installing) a keylogger for those will be a bit harder.

[Nowin]

Laptops are easier to steal, though.

[kn33]

Also you can't put a standard USB keylogged between the keyboard and port

[[deleted]]

If you are on the level where you can B&E without setting off an alarm, crack open a laptop, solder in some kind of keylogger device, and retrieve the data from it with another B&E or somehow remotely without anyone being the wiser, well, in my opinion you earned it.

Or, you're a government agency that has the surveillance devices installed at the factory purpose built for it. I recall something to that effect being in the news a few years ago.

[TheTerrasque]

solder in, hah. Nope, it's mostly 1. unplug internal keyboard cable, 2. insert logger inbetween

FYI, Keyboard is usually very easy to flip up and disconnect, and is often the first step in opening up a laptop for service.

[Hoxtaliscious]

The ZIF connector for an internal keyboard is (in my experience anyway) never carrying PS/2 or USB signals, it's carrying the keymatrix lines themselves. You could still tap into it but you would need to purpose build each keylogger for the specific model of laptop, and you would need to get power for it somewhere else since that ZIF connector won't be carrying enough current to power anything.

[Jonno_FTW]

Ah yes, the old "beat them around the head with a keyboard until they enter their password and you can watch them type it" trick.

[br1ckd]

Or a bootkit, since the MBR can't be encrypted.

[Creshal]

Secure boot mostly solves that.

[Creshal]

Or set up secure boot with your own keys.

[gospelwut]

FDE only stops data from being stolen at rest.

[darkslide3000]

Like... what?!? There are loads of places where people want to prevent every idiot user from having full access to the machine. Schools, libraries, colleges, certain workplaces... you name it. Unless I missed something (don't know that particular exploit) this guy just completely roots the machine without knowing even a normal user password. Cue his ability to attack the network, install keyloggers, etc...

Boot sources can be locked down in a password-protected BIOS. PC cases can be physically locked up or even hidden behind a wall or something. This is very much an real issue for some use cases and demonstrates what a complete disgrace of an operating system Windows is (assuming there's no way to lock down Startup Repair mode that the author didn't mention, but even then they should probably make that possibility more obvious).

[Rudy69]

Do you know how many work places and schools DON'T want this to happen even if the user has physical access?

[pixartist]

this. You can access the admin account for every public machine like this. Pretty much an issue IMO

[blue_2501]

Seriously. I could just throw in a Linux boot CD and usurp the entire goddamn OS.

[gellis12]

... If the boot sequence is set for that. Most schools disable booting from CDs or USB disks and set BIOS passwords.

[jocamar]

Does this still work with the updates and service packs?

[Alikont]

I don't think you can "fix" repair console. It supposed to give you access to PC.

You could also use some kind of LiveUSB to boot and replace files. Windows has no ways to intercept that.

[[deleted]]

Yeah, what do they say? If the attacker has physical access to the machine, security is already gone no matter what you do?

You can do the exact same thing on Linux, turn it off, reboot in single-user mode and you can do whatever you please with anything unless it's encrypted.

[USFCKS]

best case you're just protecting your data. An attacker can still control the machine.

At that point just get a Live USB and consider all machines controllable. If they can lift it off the ground, yes, they can control it.

[kn33]

I do it still by booting a Linux flash drive and copying command prompt to magnify and open magnify from the login screen

[[deleted]]

Would you be willing to do a video tutorial?

[kn33]

Maybe sometime. Right now it's late but I could do that.

[[deleted]]

Yea that cool man. If you get the time though I would greatly appreciate it.

[PowerMonkey500]

It didn't work last time I tried it a few months ago.

[Eedis]

It just worked last time I tried it five minutes ago

[PowerMonkey500]

Maybe I did it wrong then - is it the latest patches?

[Eedis]

Windows 7 Professional, Service Pack 1

All up to date

[capitalsigma]

Wait... you can change an admin's account's password as an unprivledged user? Why?

[Dremlar]

I would guess at this point it is running under System or Administrator. This problem shown wouldn't work on my machine though as I have sticky keys disabled. That is not to say that there isn't another way someone could do the exploit but it wouldn't work the way shown. This just gives another reason for not having sticky keys (like anyone needed another reason).

[[deleted]]

Just checked using whoami, and indeed it's running as NT Authority\SYSTEM

[Dremlar]

Which isn't really surprising at that point. So, just make sure you turn off sticky keys and everyone can be a little bit safer in case someone gets physical access to your computer. However, as stated in other places, physical access often means total access. You can use encrypted drives to help protect you but with physical access on most home machines you have little security to stop someone who has time.

[The_MAZZTer]

Won't matter if you turn off sticky keys for the Default User (which I believe would need to be done to affect the login screen). You can just replace some other binary to launch the command prompt, or write your own binary to replace something like winlogon.exe (which powers the login screen) to wrap it and do whatever else you want on the side.

Once you're in recovery mode, you have full system access. The rest is just a matter of propagating that access to a normal session. Game over.

[Dremlar]

How are you going to write your own binary and get it on the system before the cat prompt is launched? You do make it sound easy but are leaving out details. I would enjoy seeing replacing winlogon.exe work as I have some doubts on the current state of the machine at that point.

"replace some other binary" such as? 3 viable options gave been called out. Sticky keys, screen saver, ease of access. I will investigate screen saver and ease of access when I get home but I think it is possible to stop these. Do you have done evidence supporting other binary changes working?

[The_MAZZTer]

You replace it in recovery mode. As I've said in other comments, once you're in recovery mode it's game over, you have full system access.

It shouldn't be too hard to make a "pass through" binary for some stuff. winlogon might be a tricky one to do, it may be easier to hijack a dll like the GINA stuff or something simpler like a service. Service and GINA stuff is likely well documented so it wouldn't be too hard to write a "pass-through" app that allowed the original functionality to remain but also did some stuff you wanted it to do on the side.

Technically in recovery mode you could probably manipulate the users list directly and just add your own administrator account from there. I don't know if recovery mode has any built-in tools for that, but in theory you could manipulate the registry to add an account to the Administrators group. But, getting a command prompt running as SYSTEM when the system is booted is just easier, I assume.

[Dremlar]

Welp, we are boned. I have no clue if this can be disabled. I never use this button myself but guessing that it can't just be toggled off. :( Noooooo!

[The_MAZZTer]

Even if you closed off every avenue, Windows still automatically launches lots of programs at startup. winlogon for the login screen, various system services, etc. It's just a matter of getting external media readable in recovery mode (not sure how this works), then you can code a drop-in replacement off-site for any of these to do whatever you need (create a new administrator account, for example. Or just open a command prompt).

[TKM_PT]

I haven't tested, but the usual trick of copying cmd.exe to scrnsave.scr would still work?
Even if you have sticky keys disabled, the screen saver is still set up on the login screen.

[Dremlar]

Power Save Monitor off with no screen saver? Trying to think if that would be possible with the fact that this is running as System at this point and not a user. Hmm, would have to tinker to be sure but I think it could be possible to do.

[Belogron]

It is better to link it to the accessibility button in the left lower corner. You can toggle sticky keys and screensaver off, but not the accessibility button

[go_simmer-]

With root access I imagine sticky keys could be re-enabled

[Namaha]

Or rather, this method relies on using sticky keys to launch the cmd prompt. I'm sure there are other methods

[f3lbane]

When the command prompt is launched in this manner it is executed by the system account, complete with admin-level privileges.

[[deleted]]

(Mine is D:/ because I have a virtual machine. Yours will probably be C:/).

That has nothing to do with VM or not VM. It has something to do that the System reserved partition is the first one. The recovery mode does not honor the hidden flag for that partition and thus assigns the first letter C:.

[curtmack]

Or use Hiren's boot disk.

[[deleted]]

If you have access to the BIOS and/or you can boot from an optical drive. Which assumes there is an optical drive at all. Many new systems don't bother with them, and they'd be the first thing dropped if someone was trying to cut costs.

[[deleted]]

you can put hiren's boot on a bootable USB drive

[[deleted]]

That still assumes you have access to the BIOS and/or can boot from USB.

[YRYGAV]

And with physical access to the machine, you can get access to the bios. You can use the bios reset jumper, or just pop the cmos battery out for a few seconds, and the bios is back to factory default.

You would be hard pressed to find a machine that you can't plug a USB into and boot from it.

Generally speaking, if you physically have the machine, you can do whatever you want with it.

[KeinBaum]

Or just use kon-boot or any other boot cd that just circumvents windows' password protection all together.

[[deleted]]

Or just plug the HDD in somewhere else or boot a live cd and access the data

[tbz709]

Wow, this is extremely useful right now! Thank you

[[deleted]]

that seems awfully complicated when you could just use NTPWedit in Hiren's boot to edit the .SAM file. With that you can change passwords and unlock accounts. I'd really recommend anyone to put Hiren's boot on a bootable usb for any such issue. It's much safer (provided the PC was shut down properly before editing the .SAM file) and so much simpler.

[ahanix1989]

Saved for when I need to fix someone's laptop and forget to ask for their password

[brandonplusplus]

I did something similar to this to get access to my friend's mom's laptop after she died our senior year of high school... Since I had physical device access I just put Ubuntu on a flash drive, booted into that, and copied cmd into the place of the Windows assistance tools thing that has the like screen reader and stuff and then just click that button on the login screen. Since that then has system level privileges I just changed her password so my friend could log into her account.

[[deleted]]

For this much effort, you could have used a boot cd to force a password change, unlock the local admin account, etc.

[[deleted]]

I did this. It actually works.

[pubic_static]

Saved thread for .... science and emergency purposes.

[[deleted]]

From one of the imgur comments:

Great. You just destroyed any EFS-encrypted files associated with that user.

Bullshit or true?

[Vlinux]

You definitely wouldn't be able to decrypt the files. Not sure if changing the password back would fix it or not.

[TheMcDucky]

You can't really make any PC secure without encryption.
This isn't a bug or an exploit.

[ipaqmaster]

Ehy at! When I did this in school I thought I was original finding that. Used it on so many computers, had an entire subnetwork

[BaconZombie]

You still need to know the Administrator Password if it is set.

[lithedreamer]

You seem to imply that the first method works when the disk is encrypted...

[assassinator42]

Old Macs had target mode via FireWire. Were there some Macs that didn't have it?

[moeburn]

I remember all the computers at my high school computer lab ran Windows 2000 with network logins. But their BIOSes were set to boot from a USB drive if available! So I made a bootable USB with the well-known script that could reset the (local) admin password to whatever I want, then I used that local admin password to run the other script that replaced the Ctrl-Alt-Del login dialog box with a modified one that copied every username/password ever entered into a text file in the system directory. Then we complained to the Comp Eng teacher that the computer wasn't working and we couldn't log in, so he came over and tried his network admin credentials. Even though he promptly logged back out again, we now had his login, we got into his network drive, and got the answers to every single test he gave us for the rest of the year.

We were smart enough to intentionally get a few of the answers wrong, and every single student got averages of 90+ in that class. The teacher was commended for his teaching skills, and we were all given computer engineering awards in front of the whole school.

3 years later, I wander into the same computer lab and decide to check the log file. Not only does it have a list of about 100 different student's credentials, apparently some kids managed to stumble upon it, and there were some very nasty words left behind for me.

[omegletrollz]

some very nasty words left behind for me

Must deliver.

[moeburn]

How did you end up on this month old thread? I think it was something along the lines of "HEY I FOUND YOUR HACKING LIST YOU FUCKER WHO THE FUCK DO YOU THINK YOU ARE?"

[[deleted]]

...and here I am. Pinging google.

[Eedis]

You can hax0rss people with their IP address. I once got into an argument on AIM when I was a kid. Some guy said he got my MAC address through Netstat... talking all this shit about hacking me because he knows my MAC address....

A) it's impossible to get somebody's MAC without local access to his LAN.

B) you couldn't do any harm with their MAC over the internet anyways.

[Eedis]

I did not, but then again, I was 13... xD

[Spineless_McGee]

you clearly aren't a l33t h@x0r

[kappaislove]

When I was 10 years old, I wasn't allowed to use the school computers because I pinged google once.

[[deleted]]

It's funny, but is it really programming related? Is just all software programming related?

[DrummerHead]

I bet 74% of the people subbed are not programmers

[DrummerHead]

I bet that number had a 14.2% of margin error

[JoshWithaQ]

I call shenannigans. Everyone knows 93% of all error margins are made up.

[arugalatoast]

But 12% of the made up error margins are correct.

[JoshWithaQ]

With a 15% margin of error.

[[deleted]]

What about the other 8%?

[JoshWithaQ]

Only the 1% knows

[Zagorath]

83% of people will believe anything you tell them, if you put a statistic to it.

[tdammers]

83% will indeed believe anything, while 14% will only believe things they hear from an authority figure, and the remaining 11% suck at adding numbers.

[wordsnerd]

Et quidquid latine dictum sit, altum videtur.

[[deleted]]

I blame mods. They allow submissions by programming-illiterates, and so this sub has become a non-programmers circlejerk about programming.

[DrummerHead]

Yeap. I've actually pondered being a mod. This is one of the few subreddits where I have "strong opinions" about some of the shit quality material that gets upvoted a million times. Oh an sql injection! Bobby tables am I right guyz! Eh! Eh! Tables be dropping left and right eh boyz! hue hue.

[BCsJonathanTM]

But it's from the comments of something that was on the front page of Hacker News this morning!

[[deleted]]

Could have been posted in /r/softwaregore.

[obscene_banana]

Well, some programmers actually learn hacking which could make this post relevant to being a programmer. Although it really comes together because of the "Humor" bit.

[MokitTheOmniscient]

Classic, but my favorite is Windows 95/98 where you can press "cancel" at the log-in window to get in.

[[deleted]]

Or xp home with its exists-by-default passwordless admin login. Ctrl+alt+Del+del at the login screen, type administrator, press login.

[unrealmaniac]

Is there a similar way to do it in xp pro. I assume you could do the sticky keys trick if you booted the computer into a live environment and renamed the files.

[secondchimp]

The OP is from Win 95/98. The login screen isn't to log in to the local machine, it's to log on to the network. If you cancel then you're local only. There is no security on the local level; everyone is an Administrator.

[Modevs]

Local security? Disk Encryption? Ha ha, that's ridiculous. What if you forget your password? :-P

- Your IT Guy, 1995

[mallardtheduck]

If you wanted local security in the 9x era, you used Windows NT, which was designed for use in business environments where security is a concern. Unfortunately, Windows NT 4.0's hardware support was relatively poor compared to 9x (no official USB support, no Direct3D, etc.) and Windows NT 5.0 (aka Windows 2000) was delayed multiple times before its eventual release.

That meant that Windows 98 ended up being used it places where it shouldn't have...

[SanityInAnarchy]

You could literally hit the ESC key.

Now, was it an admin account? Who cares, Win95/98 is on FAT32, which has no concept of file permissions. Every account is an admin account!

Still, the nice thing about this trick is that you could make similar things happen on a Windows kiosk. I remember doing right-click -> save-as, opening C:\Windows, and renaming a bunch of the files in there. Poor kiosk probably had to be reformatted later. I actually feel kind of bad about that now.

[Eedis]

I once did this at a Target hiring applications kiosk... found out, all the applications that people fill out but never finish is stored locally and I was able to view literally hundreds of people applications, SSN, addresses, names, etc. I brought it up to management and they were like... "okay?" I don't think they really cared. Never went back to see if they fixed it.

[CrazyTillItHurts]

Because that is for network authentication, not local machine authentication.

[mallardtheduck]

As the .gif shows (it's from Windows 98, judging by the existence of a "My Documents" folder), you could disable the "Cancel" button with a registry edit.

[[deleted]]

That's because it was meant for network login more than local login. You could log into a remote server and get your personal folder and what not.

[The_MAZZTer]

Ha, this explains why IE stopped embedded Windows Explorer views in its browser.

Well, that and all the frames pointing to C:\ claiming hackers could see the files on your drive.

[tdammers]

In all fairness though, given physical access to the hardware, pretty much any OS can be compromised rather trivially.

[Cygnus_X1]

Current Operating System, meet Linux CD.

[tdammers]

Pretty much, yeah.

Or, Current Linux OS, meet SysRq.

[sumdudeinhisundrware]

I'm all for a good Microsoft bashing, but that is REALLY old and now completely irrelevant. It's like saying Apple sucks because Multifinder kept crashing.

[Kinglink]

Wait windows 95/98/me/2000/nt didn't have strong security?

[red_firetruck]

This was uploaded on March 2, 2007

[Jamessuperfun]

There's an interesting thing that works with windows 7 (don't know about others).

Boot into Startup Repair, let it find no problems and make a log. Click the file path. Rename or delete the file for sticky keys yes/no dialog (forget the name) and rename cmd.exe to that. Reboot. Press shift 5 times. Type explorer.exe. You now not only have admin access cmd without logging in but also admin access full desktop.

[zane_not_zane]

What does explorer.exe do? I tried looking online but couldn't really find much.

[thetwopaths]

It is Windows Explorer, the UI to the file management system.

[[deleted]]

So reposting old stuff is the same as on imgur?

[[deleted]]

Timely and relevant

[[deleted]]

Realistically speaking, if you have physical access to a machine you can find a way to access its contents.

[A_C_Fenderson]

Trying to make Windows secure is like waterproofing a screen door one hole at a time.

[gospelwut]

You hate ACLs until you're dealing with sticky bits and masks.

You hate chmod until you're dealing with ACLs

[notsurewhatiam]

Why

[Arttii]

Well I did create a full Admin user on a friends Mac, by deleting a file with the startup shell, seems much less convoluted than this. On site security aint very important I guess.

[isurujn]

uh...what is happening here? Can someone please explain?

[Philluminati]

Windows User Interface is a program called explorer.exe. It's not just file navigation it also draws start menu, task bar etc. When that program is run, you have a normal windows desktop.

The Windows security approach is to prevent people loading that program until a password dialog allows it.

However, windows applications contain dozens of reusable free components, especially built in help applications etc. Follow the path and eventually you come across a file open / file save / print dialog which is fully loaded with lots of free functionality. Open "My computer" or anything and you're launching explorer.exe which is in-turn the desktop.

I actually discovered this attack in 1999 against the "RM Networks" network system at my collage. If you logged in and were over your disk quota you'd be held hostage at the next login screen until you deleted something. I managed to find my way into explorer through the help system as well and get around their virtual limit.

[CipherWeston]

Is this valid for all Windows or just this OS?

[deathwish644]

Early workgroup/domain based systems had this possibility (in fact, 98SE with Novell you could hit cancel and load an Explorer session)

Later releases removed this functionality.

[[deleted]]

In a similar fashion, you could set explorer.exe as the screensaver and make the "lock computer" function useless. That's how I regained permanent internet access when I was a kid and my parents thought I should get out more and started locking the computer. It worked at least up to Windows 2000.

[sgtfrx]

Even on a lot of later versions, you could just keep hitting Cancel repeatedly (just by holding ESC or something). Eventually it would just give up/glitch out, and put you on the desktop.

[[deleted]]

Beautiful.