Solved

Audit Administrator Account

Posted on 2011-03-09
3
660 Views
Last Modified: 2012-06-27
Having reviewed this answer, I'm still left with quesstions..Securing the Domain Administrator account, (Q_22094429)

Do processes that have been set up previously under the Domain Admin account "break" if you change the password? (I'm guessing yes!)
If so, surely it's impossible to "Audit" all instances of the Administrators account being used, should one need to secure the account at short notice.
I need to change the password for the Domain Administrator and create a new "Support" password. (i.e It's not possible for me to have my users "forget" the existing password.)
If it was possible to change the password, without effecting any of the day to day processes, then that would be perfect. I would also need to "lock" the Domain Admin password to ensure my Support users couldn't reset it.
0
Comment
Question by:BlueprintConsultant
  • 2
3 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 250 total points
ID: 35084234
Yes if services are using that account and you don't update the PW that will break

You could try out a script to ID what accounts are being used

http://theessentialexchange.com/blogs/michael/archive/2007/11/13/finding-services-using-non-system-accounts.aspx

I haven't tested that script myself but Michael Smith is good.

By the way Microsoft knows this is an issue and introduced Managed Service Accounts in 2008 R2  http://technet.microsoft.com/en-us/library/dd560633(WS.10).aspx

MSA's are not perfect but a good start.

Thanks

Mike
0
 

Author Comment

by:BlueprintConsultant
ID: 35110907
"Yes if services are using that account and you don't update the PW that will break"

Can I just check that you mean , It WILL break the service if I change the password? - that little bit of your reply wasn't 100% clear!

The rest was excellent, I'm giving it a quick look, and will be back in a day or two..
0
 

Author Comment

by:BlueprintConsultant
ID: 35254963
That was a good tip to try the Code BY Michael Smith. (The code for a non-VB expert was slightly tricky to get round - the missing tip from his tutorial was, after saving the code as a .vbs file then you had to drag and drop the "list of computers" file you created, onto the actual vbs program for it to execute...once I'd figured that out, it went very well.)
Thanks MKline71!
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Do i need to Open Port 636 on Domain controller for setting up LDAP 3 29
SQL Help 27 45
ticket bloat 3 31
SQL Server 2012 r2 - Varible Table 3 25
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Why pager replacement is still an issue OnPage has what some might call a “hate/hate” relationship with pagers. Not much room for love. As we see it, pagers are an antiquated bit of technology. Pagers are dinosaurs which, like most dinosaurs, sho…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question