网页内的 ActiveX 控件用于创建用户帐户
我想知道是否有任何方法可以通过网页上的 ActiveX 控件编写脚本来在 Windows XP 计算机上创建用户帐户。 具体来说，我想知道是否有任何方法可以在计算机（我预先配置和交付的）上部署 ActiveX 控件，从而允许使用该计算机上的网页来检测 ActiveX 控件是否存在，并允许自动创建计算机上的本地 (Windows XP) 用户帐户。 本质上，将此视为预安装 ActiveX 控件（如果需要）并在桌面上提供链接的问题； 用户收到机器并登录（具有管理员权限）并访问网站，我的服务器在该网站上确定适当的用户帐户是什么，将它们以 HTML 形式发送回，然后 ActiveX 控件创建我指定的用户帐户。
这种事情看起来应该是可能的，但同时，也可能涉及明显的安全缺陷。 对这些机器的访问将非常有限，因此安全问题不太值得关注。
有谁知道这是否可能？ 任何内置 WMI 组件是否会执行类似的操作？ XP 的安全模型允许这样做吗？ 或者这只是打开了一个应该完全避免的巨大安全漏洞？
I'm wondering if there is any way to create a User Account on a Windows XP machine that can be done through scripting from an ActiveX control on a webpage. Specifically, I'd like to know if there's any way to deploy an ActiveX control with computers (that I preconfigure and ship) that will allow use of my webpage from that computer to detect that the ActiveX control is present, and allow for automated creation of local (Windows XP) user accounts on the computer. Essentially, consider this to be a question of preinstalling an ActiveX control (if necessary) and providing a link on the desktop; the user receives the machine and logs on (with admin rights) and goes to a web site, where my server determine what the appropriate user accounts are, sends them back as HTML, and the ActiveX control creates the user accounts I specify.
This sort of thing seems like it should be possible, but at the same time, there are obvious security flaws that are potentially involved. Access to these machines will be very limited, so the security issues are less of a concern.
Does anyone know if this is possible? Do any of the built in WMI components do anything like this? Is this even allowed by the security model of XP? Or is this just opening up a huge security hole that should be avoided entirely?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我认为 Windows 的安全模型（尤其是 IE 中）不可能允许这样做。 您可以使用 WMI 中的 Win32_UserAccount 来通过 WMI 执行此操作，因此更好的方法可能是编写一个 PowerShell 或 VBScript 脚本来查询网页以查看需要创建哪些帐户，然后创建它们。 用户需要是本地管理员。 这在 PowerShell 中更容易； 如果您从 www.sapienpress.com/powershell.asp（页面底部，免费）获取示例脚本，您将看到如何向 URL 提交查询并以文本形式返回结果的示例。 然后，您可以解析文本并相应地创建帐户。
I don't think you could ever get Windows' security model - especially in IE - to permit this. You can do this with WMI using Win32_UserAccount in WMI, so a better approach might be to write a PowerShell or VBScript script that queries a Web page to see what accounts need to be created, and then creates them. The user would need to be a local admin. This is easier in PowerShell; if you get the sample scripts from www.sapienpress.com/powershell.asp (bottom of page, free), you'll see an example of how to submit a query to a URL and get the results back as text. You could then parse the text and create accounts accordingly.
您必须使用 url 证据或强名称证据将 caspol 安全设置设置为完全信任（或自定义设置）。
确保您的控件始终获得完全信任设置后，您可以对控件执行的操作没有任何限制，可以通过嵌入式控件执行普通应用程序可以完成的任何操作。 当然，Vista UAC 和 IE 保护模式将是您必须考虑的问题。 例如，可以通过将站点添加到受信任站点区域来解决保护模式。
编辑：忽略 Vista 细节。
You have to set caspol security settings to fulltrust(or a custom set) either by using a url evidence or a strong name evidence.
After you made sure that your control always gets the fulltrust setting there are no limitations to what you can do with your control, Anything that can be done with a normal application will be possible from you embedded control. Of course Vista UAC and IE Protected Mode will be issues you have to look at. E.g. protected Mode can be worked around by adding your site to the Trusted Sites zone.
Edit: Ignore Vista specifics.