Dean, has put up a post explaining an architectural defect in the way Windows Server 2008 handles the Accessibility Options prior to login.

As Microsoft’s 3rd Law of security states, if you have physical access, then it’s not your box anymore. And this is just another good reason why physical security is one layer in your security policy. You do have a multi-layered security policy don’t you?

Really, this comes down to, why MS:

1. Give an anonymous console user the ability to kick of a SYSTEM level process. DOH!
2. Not having the GINA validate what it is launching.
3. Having this as the default and not an option. DOH! Again!
4. SYSTEM Full Control over the Active Directory – Priceless!

Windows Server 2008 is moving in the right direction, they are reducing attack surfaces out-of-the-box and producing a more secure, leaner OS, which is great. I guess they missed this one ….

The post is well worth a read, cheers Dean :)