Re: Changing the domain password policy

1. You could try to look into your AD event logs and check for Successful logons for the domain admin account.

2. Every time you identify a service using the domain admin account, replace it with a different account that is part of the domain admins group. You want accounts separated as much as possible, and you can then later evaluate whether that one service even needs domain admin level access. One service/function for one domain admin level account.

3. After you change the domain admin account, closely monitors server event logs for failed logons to the domain admin account. This should indicate the source and that there is something out there still trying to use the old password. You want to catch downed services before your users or management come looking for you.

4. Policy should dictate very complex passwords for domain admin level accounts. You want non-dictionary words, 16+ characters, and mixed alphanumerics and cases and special characters. You don't necessarily have to regularly change service passwords as perhaps the business interuption is not worth the password change, but you really should still be aware of what services are out there, what account they use, and limit them as much as possible (maybe run as a privileged normal domain user?). The root domain admin account should be used as little as possible and the password rotated regularly.

5. If you do want to still rotate and change passwords for services, look at your inventory and set up a reminder to change passwords. I would avoid setting an expiration date for service accounts that you aren't really sure when they will be removed. Besides, if you're a day late and the account is locked, your business may be threatened.

6. You really should have different standards for different account types. The root domain admin account is one type all by itself. Any other accounts in the domain admins group should be another. All service accounts should be another. And lastly your regular domain user accounts. While you can, and should, use AD policy to force complexity for domain user accounts, you really want to practice more complex passwords for the other types.

While the biggest thing to do is make sure you know your environment and what service accounts are used where, eventually you'll find yourself stuck and you just need to make the change and deal with what breaks.



<- snip ->
Time has come to change the domain admin password. Unfortunately this is
used (hardcoded?) across the network in lots of different places,
services, virus downloads etc. Does anyone know of a way for me to audit
the admin account so I can see where it is currently in use.

Has anyone got any other tips for changing the domain admin password
without lots of pain?

Thanks,

Hi All,

I wish to amend my windows domain policy to include passowrd complexity
and minimum length. However I have a bunch of service accounts, of which
I do not know all. These passswords are set in AD to not expire. Am I
right in thinking that the changes to the domain password policy will
not effect the accounts that have this attribute set in AD, until these
passwords are actually changed?

How do other people deal with service accounts and their adherence to
domain password policys?

Relevant Pages

  • Re: Service accounts best practices
    ... > The only people who should have domain admin rights are the exact people ... > domain admin work and it should be a very small group. ... >>>Joe Richards Microsoft MVP Windows Server Directory Services ... >>>>Can someone point me to a guide to securing service accounts? ...
    (microsoft.public.win2000.security)
  • Re: Permissions to unlock Administrator account?
    ... Use delegation for everything else. ... The Administrator accounts should have a very long, complex, password, be ... domain admin, and one for general day to day use. ... leaving only the Administrator account there (I ...
    (microsoft.public.windows.server.active_directory)
  • Re: Securing workstations from IT guys
    ... It sounds like you have generic domain admin accounts - I'd change that immediately, and create what are called 99 accounts. ... Change all Local Admin passwords so that even IT helpdesk/other doesn't know them. ... Is there an auditing on PC that can be enabled to track/log incoming connections to C$ and pop up and alert whenever someone tries it out from a remote machine. ...
    (Security-Basics)
  • Re: NT4 to Windows 2003 AD Migration Question
    ... You want something that can map the accounts from the source to the ... > I have around 1500 workstations, a couple hundred servers. ... > seems most tools want domain admin on the AD side as well. ... We are tasked with building the OU from scratch, so SID history ...
    (microsoft.public.windows.server.active_directory)
  • RE: Changing the domain admin password.
    ... You can use logon account auditing to track the use of the domain admin ... custom service accounts with the necessary privileges whenever possible. ... Time has come to change the domain admin password. ...
    (Security-Basics)