Disable administrator log on locally. Any issues?

[dany2010]

Hi.

 

Im thinking about blocking the domain administrator log in access to pcs as it should never be used.

 

If I set deny log on locally in the gpo would it have any affects on other things such as software installations in gpo or scripts?

 

Thanks

[Michael]

You're much better off renaming the Domain Administrator account and specifying a strong password. Then create a new dummy account called 'administrator', make it a member of no Security Groups with a strong password. Even if someone like magic guesses it, they'll get access to nothing at all.

[dany2010]

It would to prevent pupils. But I'm trying to prevent administrators .

 

Yup, it's got that bad. I've had to put in policies for domain admins. (I'm not the manager so doing my best to save destruction)

Edited June 18, 2013 by dany2010

[pantscat]

How many domain admins do you have?!

[FN-GM]

You're much better off renaming the Domain Administrator account and specifying a strong password. Then create a new dummy account called 'administrator', make it a member of no Security Groups with a strong password. Even if someone like magic guesses it, they'll get access to nothing at all.

 

On my recent MS course they recommend disabling the built in account and making a new. Apparently all the default administrator accounts on a domain have the same GUID.

[AngryTechnician]

It would to prevent pupils. But I'm trying to prevent administrators .

Then you've already lost the battle. Any restriction you put in place can be removed by a Domain Administrator.

[dany2010]

Then you've already lost the battle. Any restriction you put in place can be removed by a Domain Administrator.

 

Nightmare int it. Warning can be given for gpo changes though for the ones that don't do it.

 

I would ask for more things that could lead to warnings but they forget.

Edited June 18, 2013 by dany2010

[Michael]

That's probably true, but renaming the account should be just as good. Still it's not going to stop the problem specified in this thread.

 

The only alternative in Active Directory is to double click the admin user object > Account (tab) > Log On To, then specify only the servers and admin workstations.

[dany2010]

Yeah. Sound similar to the gpo way.

 

Would it cause any issues with scripts or software installations?

 

As far as I'm aware these don't use the administrator account but have never really got round to looking what account they actually use.

[sted]

could you not addd/alter their logon script such that if in pc01 shutdown /l

[fiza]

How many administrators do you have?

If they cant be trusted why are they administrators in the first place?

[Duke5A]

I had this exact same issue when I took my new job. The district I'm in handed out domain admin credentials like it was candy on Halloween; there must have been almost a dozen media paras and teachers that had it. It was their easy solution to getting people the access they needed to do their job. I spent about a week creating restricted accounts/groups that had the access to do particular job functions and handed them out to the people that needed them. Once I weened everyone off of their domain admin addiction I changed the passwords. Don't just take away access they need. One example of the issues I faced was select staff would reset student passwords in the buildings, so I created a .Net app with search functionality that would allow them to reset/unlock student accounts. If you give them an alternative to do their job that is easier you shouldn't have any problems.