0
In my organization we use mstsc all the time to remotly access other computers in our LAN. If you want to do it, you firstly need to be logged in the local computer to be able to run mstsc.exe.
In friend's company i've seen that in the windows lock screen, they don't have to log in, but they have button in the corner that pops up mstsc and thre can access other computer without logging in even once and without user/permissions to the local machine (just the remote one).
I couldn't find anyone there to explain me how did they do this cool thing.
How can it be done? (Windows 7/8/10)
Y. Shoham
Posted 2019-05-14T08:19:08.173
Reputation: 149
I bet they are using thin clients. They are designed to operate this way. – LPChip – 2019-05-14T08:23:57.790
See also: https://social.technet.microsoft.com/Forums/en-US/9339ffde-23db-4a60-a5a2-2247e4b34d3b/start-remote-desktop-from-windows-lock-screen?forum=w7itprosecurity
– LPChip – 2019-05-14T08:25:24.457It is also possible they use an alternative shell. One that actually runs in a users context but makes it look like the screen is locked and by typing in a password switches to the explorer (desktop and taskbar) shell. – LPChip – 2019-05-14T08:26:52.200
1Years ago, there used to be a trick where you could run an executable inside the windows folder without logging in. I don't remember the name of the exe but it was used by people with disabilities, it assisted them with logging in. The trick was to replace the exe with a different one (like cmd.exe) but give it the same name. You could then run cmd.exe without logging in, and (potentially) hack the machine. Haven't tried it lately, and last I heard MS was going to do something about it. Anyway this reminds me of it. – Larryc – 2019-05-14T08:40:05.370