Re: local administrator account password policy

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 01/03/05 

Date: Mon, 3 Jan 2005 13:12:52 -0600

Password maximum age is generally a function of the length and complexity of
the password and who uses the local administrator passwords and are they
capable/trusted users. You certainly can configure those accounts to never
expire if that will work for you and your level of risk management. If
computers that hold critical data are physically secured, then you have much
less risk of local administrator passwords being compromised as it is easy
to reset the admin password if you have physical access to a computer.
Forcing local administrators to use a password [or better yet pass phrase]
of at least 10 characters with password complexity enabled would, everything
else being equal, allow those passwords to have a much longer maximum
password age. Disabling storage of lm hashes [assuming all W2K/XP Pro/W2003
computers] will make password cracking much more difficult after the policy
has been enabled and the password changed. Another possibility is to disable
the built in admin account [XP Pro/W2003] or giving it a really long complex
password for W2K and then issue those users that need local administrator
account access smart cards. Smart cards are not all that expensive and
fairly easy to configure. Don't underestimate social engineering in your
plans to secure your network. Most non technical users are very trusting to
requests for passwords etc. if they do not know any better. Auditing of
account logon events and account management in Domain Controller Security
policy and logon events on domain computers should also be a part of your
security strategy. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;299656 -- note
that the procedure differs for W2K and XP/W2003. Configuring security policy
on a Windows 2003 domain controller to disable lm hash will NOT apply to W2K
computers - they must have registry change.

"Eric Gurney" <egurney@iname.com> wrote in message
news:ewjqNOc8EHA.824@TK2MSFTNGP11.phx.gbl...
>I am getting ready to implement (finally) a strong password policy on my
>small network. My question is how to handle the local Administrator
>accounts password policy. Should I put that on the same password
>expiration schedule as domain accounts and change it as needed (which
>should be rarely), or exclude that account from the expiration limits?
>
> Thanks,
> Eric
>
>

Relevant Pages

  • Re: WK2 AD Security
    ... Well the link I referred to should be a good start on account policy but ... guest account is disabled on the domain controller in AD Users and Computers ... -- Create a password policy suitable for your needs but consider enabling ... network" setting on the domain controller or in DC Security Policy. ...
    (microsoft.public.win2000.security)
  • RE: using groups to assign "log on to" computer permissions
    ... Myself, I'd use Group Policy. ... > highlite the users in ADU&C, ... >> have been selecting each user's account in Active Directory Users and Groups, ... >> computers are added or changed, we have to edit each account individually. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Can not log on to domain controller remotely or locally.
    ... log on as the local Administrator and schedule a task that ... policy via SECEDIT command line utility) in the security context of the ... local SYSTEM account following the regular reboot. ... to remote desktop into the server and I get the message "To log on to this ...
    (microsoft.public.windows.server.active_directory)
  • Re: Joined workgroup, now login doesnt work
    ... Administrator account which is a *local* account. ... Your home computers *do* have user accounts - you just don't realize it ... That left the local Administrator account. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Group Policy
    ... but somehow that policy doesn't take effect on those computers although ... I set the policy setting to "DISABLED" for the policy named "Password must ... meet complexity requirements". ... In a domain -- there can be only one password (account) policy and this ...
    (microsoft.public.windows.server.security)