IBM GINA, when used for OS/2 domain authentication of Windows NT users, allows local users to gain administrator privileges by changing the GroupMapping registry key.
source: wwwsecurityfocuscom/bid/608/info
IBM has written a replacement GINA for Windows NT to allow NT hosts to authenticate against OS/2 domains On machines running the modified GINA, the creation of a specific Registry key under HKLM\System\CurrentControlSet\Services\IBMNeTNT may allow a user to add any Group to the "Local Administrato ...