Re: obtain user's password?

From: Roy Avery (roy_avery_at_nospam_cmwlaw.net)
Date: 05/29/03 

Date: Thu, 29 May 2003 09:26:55 -0700

"as there's no good reason to need everyone's password (this is what
administrative rights are for)." That's what I said, but our office manager
won't hear it.

Where can I find good arguments to convince these people that it isn't
necessary to have the user's password? They are worried that if a secretary
is sick and we need to bring in a temp, how would the temp access the
secretary's calendar? I told them that I can just reset the password if
necessary.

Thanks.

"Keith W. McCammon" <km@km.com> wrote in message
news:e3A4XzfJDHA.336@tk2msftngp13.phx.gbl...
> > Our office manager would like a list of all of the domain users
passwords.
> > Is there a way I can retrieve the passwords?
>
> Only by brute-force. L0phtcrack can do it for $350US. However, you'll
need
> to run it pretty regularly if you require an up-to-date list, which can be
> very time-consuming on larger networks (and even on some smaller networks
> with security-conscious users). In general, these things are to be used
for
> auditing, not for password management, as there's no good reason to need
> everyone's password (this is what administrative rights are for).
>
>