Question on memory dump acquisition

I would think that you do NOT want to log off the machine then back on with a different admin account as you would lose the contents of the memory on hand, thus negating a lot of very important information.

Logging out of the current user account and logging in as an admin wouldn't necessarily mean rebooting. To log in as a different user, you wouldn't need to shut the system down completely.

Also, without having to logout, how about using RunAs…
http//support.microsoft.com/kb/294676
http//support.microsoft.com/kb/305780

I would think that you do NOT want to log off the machine then back on with a different admin account as you would lose the contents of the memory on hand, thus negating a lot of very important information.

Logging out of the current user account and logging in as an admin wouldn't necessarily mean rebooting. To log in as a different user, you wouldn't need to shut the system down completely.

Also, without having to logout, how about using RunAs…
http//support.microsoft.com/kb/294676
http//support.microsoft.com/kb/305780

I thought about that, using RunAS.
For me, there has been a few times where we needed to grab memory dumps of a system while the user was logged in (weird/nasty stuff in memory that we wanted to capture). However, if you logged off the user and logged on with a different user, the memory is different, and at times, we would not get everything we needed, thus loosing precious information.

I have tried using Windows memory dump utility, but for whatever reason, that seems to be hit or miss.

Thanks for the help.

I will continue to look around.

Thanks,

Jason

Are you in a position to use F-Response to connect to the remote machine? If so you can use tools on your local machine against the memory in the remote machine.

Also give FTK Imager LITE a test as well. It can be unpacked/unzipped to a folder that can be run from a USB drive on a suspect machine without installing the program locally. You have the option of doing a memory acquisition on the suspect machine and dumping the memory image to the USB drive. Obviously take careful notes and understand the changes that are made to reg keys and such when running the program so you can explain any changes to suspect machine by your actions.

Do be familiar with the runas option by right clicking on a executable, batch, shell, etc. file as each system can have different group policy settings that can restrict certain Windows functions and/or programs from executing. The group policy editor is a topic unto itself but be familiar with gpedit.msc (Start->Run->gpedit.msc) in general to know where your hands might be tied.