981
mv Windows Linux (discuss.tchncs.de)
submitted 2 years ago by to c/linuxmemes@lemmy.world
104 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 155 points 2 years ago (23 children)

Anyone who has to use Windows and suffers this, PowerToys is your friend. Locksmith identifies what's locking your file and allows you to free it up. Dunno why PowerToys isn't bundled by default tbh.

  • permalink
  • fedilink
  • source
  • hideshow 23 child comments
    •
  • [–] 111 points 2 years ago (5 children)

    Dunno why PowerToys isn't bundled by default tbh.

    PowerToys give the user more power, which goes directly against Microsoft's own goal.

    Also, less seriously, "toys" implies the user might enjoy the experience, and you know they can't let that happen.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [+] -29 points 2 years ago (4 children)

    Shut up. It is literally made by Microsoft. As a place to experiment what to include in Windows. Don't argue with strawmen

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 31 points 2 years ago (2 children)

    Shut up. I also think power toys that feature basic functionality and have been around for decades should be included in Windows. I can’t always install this on a computer that needs it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 11 points 2 years ago (6 children)

    Also please pre-install the sysinternals suite, thanks

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 11 points 2 years ago (5 children)

    Psexec can be pretty dangerous. Psexec.exe -i -s gives you access to the NTAUTHORITY/SYSTEM account, which is higher than Administrator. One time at work I was trying to do something and was getting permission denied so I decided to use that to get around the problem, I got to spend the afternoon talking to our security administrator because he got a bunch of alerts from our antivirus.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 5 points 2 years ago (3 children)

    Never thought about that, but since these tools just work, when you copy them to your PC.... how does psexec do that? It'd either need you to be an administrator (and then it's not really a privilege escalation as you could have registered any program into the task scheduler or as a service to run as SYSTEM) or it'd need a delegate service, that should only be available when you use an installer - which again wasn't was has been done when just copying the tool.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 2 years ago* (last edited 2 years ago) (2 children)

    You need Administrative permissions for psexec. It uploads a file to the target computer's \admin$ share (just C:\Windows) and starts a service to execute it. Services run as SYSTEM so that's why you get those privileges.

    (Hah, I forgot your message while typing mine and just copied you :)

    Edit: fixed c$ to admin$

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago* (1 child)

    I found a blog post outlining exactly that. If you use it locally, it will install and start a service temporarily. That service runs as SYSTEM and invokes your command. To succeed, you need to be a local administrator.

    If you try the same remote, it tries to access \\remote-server-ip\$admin and installs the service with that. To succeed your current account on your local machine must exist on the remote machine and must be an administrator there.

    So in short: It only works, if you've already the privilege to do so and the tool itself is not (ab)using a privilege escalation or something like that. Any hacker and virus may do the very same and doesn't need psexec - it's just easier for them to use that tool.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 2 years ago*

    I recently discovered Resource Monitor (resmon) can do that, too!

    I was using Unlocker waaaay back, I loved it. Since then I wasn't looking for alternatives, but since resmon also can do that, it's more than enough.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 2 years ago (3 children)

    I always thought it wasn’t included by default to mitigate malware damage to a system. Malware needs to be just a little bit more advanced if it can’t hijack Powertools to do what it wants

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 2 years ago* (2 children)

    Any self-respecting malware writer will download and decompile the Powertools to find out what API calls are being used. Especially if they're calls to an undocumented API.

    Having Powertools on your computer is thus not the security hole it might appear to be.

    The fact they exist at all - well that's not really a security hole either. Their existence just more quickly dissolves any security-by-obscurity that might have existed. Someone would have found those calls another way.

    One might suppose that they contain something special that's not in the stock OS, but then we're back to the malware writer's reverse engineering which would lead them to learn and implement their own versions of whatever it is that Powertools does.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 2 years ago*

    will download and decompile the Powertools

    PowerToys is open-source, so no need to decompile. https://github.com/microsoft/PowerToys.

    This is the code that determines which processes are holding on to the specified files (or any files in the specified folders): https://github.com/microsoft/PowerToys/blob/a89f9f69768ace73de21dbf6020bd7fa2460bf4a/src/modules/FileLocksmith/FileLocksmithLibInterop/FileLocksmith.cpp#L18

    Called from the UI code here: https://github.com/microsoft/PowerToys/blob/a89f9f69768ace73de21dbf6020bd7fa2460bf4a/src/modules/FileLocksmith/FileLocksmithUI/ViewModels/MainViewModel.cs#L112 which also has the code to kill the processes

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 2 years ago

    I would not say

    any self-respecting malware writer will download [powertools] and…

    I’m not as familiar with mass-market malware, but APT-level gear generally doesn’t try to make use of such easily observed events. The more network traffic malware appropriates, the greater the probability that it’s caught.

    Simply put, Powertools puts several functions within arms reach for malware looking to stay under the radar. Without it, malware needs to bring more of its own code which increases footprint. Living off the land exploits in particular love the presence of these kinds of programs

  • permalink
  • fedilink
  • source
  • parent