Local Policy

[bertrand24]

Please answer the following

"OpenSSH for Windows" version
7.7.1.0

Server OperatingSystem
Windows Server 2016 Standard

Client OperatingSystem
Windows Server 2016 Standard

Bug ?
in local security policy, (security Policy, Local Policy, User rights Assignement, Log on as Service), I noticed that each ssh Session is added to the policy "log on as service" with a username VIRTUAL USER \ sshd_ <pid_nr>.
when the session is over, this VIRTUAL USER is not removed from the policy
is there a process to clear these entries from the policy ?

Thanks
Bertrand

[gayantd]

Agree. I have seen same behavior in Win2008R2.

[NoMoreFood]

@manojampalam User right assignments are only necessary for initial token generation -- once the process is initiated, it is no longer necessary for the policy to exist; maybe the code could add/remove the policy entry as necessary?

[manojampalam]

@bertrand24 good catch.

We need to add clean up logic. I believe we can remove the assignment right after token generation. We need to have the fix tested in @dwatley 's environment. I was not able to repro the original issue (that mandated this privilege assignment), on my side.

We need to do a LsaRemoveAccountRights after token generation in generate_sshd_virtual_token(). @NoMoreFood do you want to follow up with a fix?

[dwatley]

@manojampalam - Happy to test.

[NoMoreFood]

@manojampalam Yeah, I'll look into this.

[NoMoreFood]

Pull request is in. This will address the behavior go-forward; current, orphaned entries will have to be removed manually (you can Shift-Click to select/remove them all in the policy editor).

[gayantd]

Awesome !!!
Thanks for quick fix !

[manojampalam]

Changes look good. @dwatley , can you validate the fix on your end please?

[dwatley]

@manojampalam - Cleaned up the existing entries and built from master. Works as expected, no issues here.