Re: Helpdesk as local admin



IMO, the worst practice is the "standard password on a local admin account"=
. This is essentially unchangable on a large network; anyone who ever knew =
it stands a really good change of it still being valid on random laptop, so=
ld-off hardware, etc. It's wrong for many reasons. Another bad solution is=
the "well-known and shared" domain admin password. It too has many bad pro=
perties, tending to leak, needing changed when staff changes, and producing=
untrackable changes.

It's not intuitive, but you are far better off giving each help desk tech a=
n individual domain admin account - in addition to a personal user account.=
And encouraging/enforcing the use of "runas" to execute commands.

Advantages of a per-tech admin account: No shared password; no "plausible d=
eniability"; simpler termination handling; cleaner logs. You do audit priv=
ilege use, right?

Over twenty-five years, I have become convinced that anything leading to sh=
ared and reused passwords is just plain wrong, and you must always find a s=
olution that doesn't involve more than one person using the same password.

--
Henry Troup
htroup@xxxxxxx

On Sat Feb 3 8:58 , WALI sent:

Hi Guys..

So what's the defined best practise regarding HelpDesk personnel be=20
given/told local admin account names and passwords on users PC/Workstation=
s=20
in order to undertake routine fault finding and applications installation?

Help Desk techies also regularly inserts new workstations into the domain=
=20
hence they need certain privileges to be able to make new workstations joi=
n=20
the domain. What could be the most secure way given the fact that Servers=
=20
are running Win 2k3 and client machines are a combination of WinXP and Win=
2k.



Relevant Pages

  • Re: Domain Profiles Borked - Cant Grant Admin Rights - HELP!!!
    ... > status of their account. ... local Admin rights were given to ... > afflicted machine and give them local Admin rights, ... the SID of your users is no longer the same as it was. ...
    (microsoft.public.windowsxp.setup_deployment)
  • RE: Installation - What Account is needed?
    ... Microsoft or others may talk about not using a local admin account to run the ... SQL Server services. ... and I don't think that is best practice in the real world, ...
    (microsoft.public.sqlserver.setup)
  • RE: local admin account password
    ... Do you think if someone wanted to break the local admin account they ... more recovery console and don't think cached logins will work. ... 5)My main idea/plan is to store all the passwords on a central SQL server. ...
    (Focus-Microsoft)
  • Re: Problems installing SQL Server 2005 in two node cluster
    ... the SQL Server service account does not need to be a local admin. ... > -> Purging the setup files from the registry with the Windows Install ...
    (microsoft.public.sqlserver.clustering)
  • Re: Distribution lists
    ... Also I have found that making that account the local admin does bupkiss ... local admin rights on the sharepoint server. ... I have made the Sharepoint Central admin app pool owner of the OU I ...
    (microsoft.public.sharepoint.windowsservices)