Nessus + Authentication = Root?

[Dave Aitel <dave () immunitysec com>]

Hmm.
http://www.nessus.org/documentation/nessus_domain_whitepaper.pdf

So a lot of Nessus's new checks require Nessus to log in remotely to 
machines using administrator passwords. It uses this to read the 
registry or check for installed RPMs or whatnot. They recommend opening 
up a domain administrator account that has minimal privs, but my guess 
is that you could use this domain administrator account to connect to 
named pipes and render otherwise post-auth bugs quite useful.

So my question to the list is this: Does anyone with experience using 
Nessus use this functionality, and if so, are you worried about someone 
in the scanning range playing with the cryptography (aka downgrading to 
plain text authentication, mitm, weak IV, etc) to get the Nessus Test 
Domain Admin account from you in order to exploit the rest of the network?

Perhaps some testers are not smart enough to use a restricted access 
domain administrator account? I know Tenable is on this list - what's 
the story on this stuff?

-dave