Solved

Audit Administrator Account

Posted on 2011-03-09
3
659 Views
Last Modified: 2012-06-27
Having reviewed this answer, I'm still left with quesstions..Securing the Domain Administrator account, (Q_22094429)

Do processes that have been set up previously under the Domain Admin account "break" if you change the password? (I'm guessing yes!)
If so, surely it's impossible to "Audit" all instances of the Administrators account being used, should one need to secure the account at short notice.
I need to change the password for the Domain Administrator and create a new "Support" password. (i.e It's not possible for me to have my users "forget" the existing password.)
If it was possible to change the password, without effecting any of the day to day processes, then that would be perfect. I would also need to "lock" the Domain Admin password to ensure my Support users couldn't reset it.
0
Comment
Question by:BlueprintConsultant
  • 2
3 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 250 total points
ID: 35084234
Yes if services are using that account and you don't update the PW that will break

You could try out a script to ID what accounts are being used

http://theessentialexchange.com/blogs/michael/archive/2007/11/13/finding-services-using-non-system-accounts.aspx

I haven't tested that script myself but Michael Smith is good.

By the way Microsoft knows this is an issue and introduced Managed Service Accounts in 2008 R2  http://technet.microsoft.com/en-us/library/dd560633(WS.10).aspx

MSA's are not perfect but a good start.

Thanks

Mike
0
 

Author Comment

by:BlueprintConsultant
ID: 35110907
"Yes if services are using that account and you don't update the PW that will break"

Can I just check that you mean , It WILL break the service if I change the password? - that little bit of your reply wasn't 100% clear!

The rest was excellent, I'm giving it a quick look, and will be back in a day or two..
0
 

Author Comment

by:BlueprintConsultant
ID: 35254963
That was a good tip to try the Code BY Michael Smith. (The code for a non-VB expert was slightly tricky to get round - the missing tip from his tutorial was, after saving the code as a .vbs file then you had to drag and drop the "list of computers" file you created, onto the actual vbs program for it to execute...once I'd figured that out, it went very well.)
Thanks MKline71!
0

Join & Write a Comment

Suggested Solutions

Email signature management is something that is often overlooked in many organizations or is simply not implemented effectively. Let's take a look at what methods are available for managing this important piece of corporate branding.
Ever needed a SQL 2008 Database replicated/mirrored/log shipped on another server but you can't take the downtime inflicted by initial snapshot or disconnect while T-logs are restored or mirror applied? You can use SQL Server Initialize from Backup…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now