Solved

Audit Administrator Account

Posted on 2011-03-09
3
662 Views
Last Modified: 2012-06-27
Having reviewed this answer, I'm still left with quesstions..Securing the Domain Administrator account, (Q_22094429)

Do processes that have been set up previously under the Domain Admin account "break" if you change the password? (I'm guessing yes!)
If so, surely it's impossible to "Audit" all instances of the Administrators account being used, should one need to secure the account at short notice.
I need to change the password for the Domain Administrator and create a new "Support" password. (i.e It's not possible for me to have my users "forget" the existing password.)
If it was possible to change the password, without effecting any of the day to day processes, then that would be perfect. I would also need to "lock" the Domain Admin password to ensure my Support users couldn't reset it.
0
Comment
Question by:BlueprintConsultant
  • 2
3 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 250 total points
ID: 35084234
Yes if services are using that account and you don't update the PW that will break

You could try out a script to ID what accounts are being used

http://theessentialexchange.com/blogs/michael/archive/2007/11/13/finding-services-using-non-system-accounts.aspx

I haven't tested that script myself but Michael Smith is good.

By the way Microsoft knows this is an issue and introduced Managed Service Accounts in 2008 R2  http://technet.microsoft.com/en-us/library/dd560633(WS.10).aspx

MSA's are not perfect but a good start.

Thanks

Mike
0
 

Author Comment

by:BlueprintConsultant
ID: 35110907
"Yes if services are using that account and you don't update the PW that will break"

Can I just check that you mean , It WILL break the service if I change the password? - that little bit of your reply wasn't 100% clear!

The rest was excellent, I'm giving it a quick look, and will be back in a day or two..
0
 

Author Comment

by:BlueprintConsultant
ID: 35254963
That was a good tip to try the Code BY Michael Smith. (The code for a non-VB expert was slightly tricky to get round - the missing tip from his tutorial was, after saving the code as a .vbs file then you had to drag and drop the "list of computers" file you created, onto the actual vbs program for it to execute...once I'd figured that out, it went very well.)
Thanks MKline71!
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
Why pager replacement is still an issue OnPage has what some might call a “hate/hate” relationship with pagers. Not much room for love. As we see it, pagers are an antiquated bit of technology. Pagers are dinosaurs which, like most dinosaurs, sho…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

680 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question