How do you do....it? Thread, How does your school handle Tech accounts. in Technical; I am looking to overhaul things here, currentlt techs log in using the Domain admin account when ever tey want ...
9th November 2009, 12:06 PM #1
How does your school handle Tech accounts.
I am looking to overhaul things here, currentlt techs log in using the Domain admin account when ever tey want to do anything (I know, I know we should not be doing it), I want to change things to proper best practice and was wondering how you set your tech accounts up, what privileges do you give them, do you use a specific GPO etc.
9th November 2009, 12:25 PM #2
We used to have a single account all our techs used but with people leaving etc the password had to be changed often and it was hard to keep track of who knew what. It was also impossible to audit, so now all the techs have their own account with no restrictions.
9th November 2009, 12:35 PM #3
We have one domain administrator account, a system administrator account and then our own individual logins which are just regular staff accounts. On a daily basis we can do everything we need from the staff accounts.
9th November 2009, 12:37 PM #4
We have an admin account and our own individual accounts which also have admin rights.
9th November 2009, 01:13 PM #5
- Rep Power
what o/s are you using, if you are using windows 2003 r2 create a tech group decide what right's they have.You can then add or take away members when you want too.
9th November 2009, 01:19 PM #6
I'm on my own, but I have my own Domain Admin account - logging on as Administrator is a last resort.
However, my Domain Admin account is not my day-to-day account... too dangerous, I don't trust myself!
My main account has conventional staff privileges. I do most things from that (including Remote Desktop into the server), only using the Domain Admin account if I have to.
9th November 2009, 01:19 PM #7
We have our own accounts, plus an admin account each. Eg. "bob.smith" and "bobadmin"
Thanks to tom_newton from:
plexer (9th November 2009)
9th November 2009, 01:50 PM #8
- Rep Power
Everyone has their own accounts. Of course domain administrator account separate, though most of us have enough rights not to need it. All students/stuff, etc have their own accounts as well. It's pretty simple, we have automated batch scripts that add account for us. We use GPOs made with different restrictions for staff/students.
9th November 2009, 02:13 PM #9
We have a normal staff user account, a .admin account which has delegated permissions for the jobs that we do (local admin on workstations, servers and delegated permissions to ad, gpmc etc). Only the network manager has an admin account with domain admin privileges.
9th November 2009, 07:24 PM #10
Here currently I have my own standard user account, a standard domain account which is added to the local admins group on each workstation and then domain admin accounts are only used on the servers.
Part of the system I inherited and seems to work quite well actually.
9th November 2009, 11:46 PM #11
IMHO, best practise is as per Tom_Newton's post.
Each users gets a 'standard' account which can be used to log on to the domain and do basic working tasks (Office, Email, Internet etc).
Any users who perform 'admin' tasks should have an additional user account, also unique to them which is used just these purposes.
This follows the principles of least privilege. Users needing to do 'admin' tasks either log on to a PC with their admin account or (as I do) use RunAs to run an Admin tool with elevated privileges.
The Admin account should also only have the essential permissions. For example, my own 'admin' account has not access to Internet or Email as this would duplicate what I can already do with my normal account.
This way of working is initially burdensome to those used to logging on as a Domain Admin all the time but it's surprising how quickly you get used to it.
10th November 2009, 12:06 AM #12
IT staff have there own account with Domain Admin rights.
The Administrator account everyone uses for server stuff
10th November 2009, 11:20 AM #13
Thanks for all te replies, it's given me something t work with now. Thanks.
10th November 2009, 11:44 AM #14
We have a domain admin account that everyone (members of the IT team of course) uses BUT it's only allowed to logon to servers. Each user has an ordinary user account for general use then we have a domain user that we make a member of local administrators on all stations using GPO restricted groups. This account has no access to the servers or shared areas it can only see our software share and a tools folder for troubleshooting.
10th November 2009, 12:00 PM #15
All our servers run TS so we each have our own accounts which are domain admin accounts and we each individually log onto servers so all stuff can be accounted / attributed to an individual user.
By RallyTech in forum How do you do....it?
Last Post: 6th November 2009, 08:08 PM
By LCPSWolf in forum How do you do....it?
Last Post: 5th September 2009, 02:40 AM
By dunkydonut in forum General Chat
Last Post: 16th September 2008, 12:34 PM
By ITWombat in forum General Chat
Last Post: 12th March 2007, 12:06 PM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)