Lee Turner is correct, a default RM machine running Windows 98 (or 95...) will allow local admin if it can't reach the network. Since such machines would be deployed in schools and sometimes by people who do not know anything about what they are doing, this attack can work rather well.
However, RM's defaults are worse than that, as all restrictions are stored in the registry, so you can just as quickly unrestrict yourself with modification of a few keys... Jessica _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/