CVE-1999-1358
MediumExploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
In Windows NT and Windows 2000, when an administrator changes a user policy, the policy is not properly updated if the local ntconfig.pol file is not writable by the user. This could allow local users to bypass restrictions that would otherwise be enforced by the policy.
Risk Assessment
The organization may be at risk of local users bypassing security policy restrictions, potentially leading to unauthorized access or actions.
Recommendation
It is recommended that administrators ensure the ntconfig.pol file is properly secured against write access by unauthorized users.
Original NVD description (English source)
When an administrator in Windows NT or Windows 2000 changes a user policy, the policy is not properly updated if the local ntconfig.pol is not writable by the user, which could allow local users to bypass restrictions that would otherwise be enforced by the policy, possibly by changing the policy file to be read-only.