jimbopembo Posted July 23, 2014 Posted July 23, 2014 I'm taking over the support contract for a primary school, and the previous company doesn't seem to wish to pass on the domain admin username and password. No-one at the school knows these details either! Eventually, the Office manager managed to obtain a password that I have tried (with numerous permutations!) and doesn't work. So I have called them myself (a bit frosty - to be expected I suppose) and the person I need to speak to will get back to me (yeah right still waiting) So........ I would be interested to know how others have dealt with similar situations. I have physical access to the domain controller. What are the SAFE options to reset the administrator password? I am inclined to name and shame - this is highly unprofessional. Are we allowed to do that on this forum?
jamesreedersmith Posted July 23, 2014 Posted July 23, 2014 are there any staff accounts who may have been domain admins or system accounts that may be domain admins (i know neither should be but may be) and use these to reset domain admin.
psydii Posted July 23, 2014 Posted July 23, 2014 Ask the head teacher to step in. Explain what information you require and then ask them to call/chair a handover meeting.
jimbopembo Posted July 23, 2014 Author Posted July 23, 2014 Psidii I wish it was that simple. They are saying the password is correct and the only one they have, and that's it!
siuko Posted July 23, 2014 Posted July 23, 2014 If that is the correct password are you trying to log on with it locally onto the server or using the domain login? As they can be different? eg domain name\administrator is different to computer name\administrator Sorry if it sounds obvious
featured_spectre Posted July 23, 2014 Posted July 23, 2014 password may well be right, but the question is, for what username is it used?
mtillbrook Posted July 23, 2014 Posted July 23, 2014 Hey guys I've had this exact same problem in the past and my solution was this post: How to Reset Your Forgotten Domain Admin Password on Server 2008 R2 It worked perfectly for me!!
unixman_again Posted July 23, 2014 Posted July 23, 2014 Why not simply remove the password with Offline Windows Password & Registry Editor ?
plexer Posted July 23, 2014 Posted July 23, 2014 Doesn't work for a domain joined machine the same way. Ben
FN-GM Posted July 23, 2014 Posted July 23, 2014 Hey guys I've had this exact same problem in the past and my solution was this post: How to Reset Your Forgotten Domain Admin Password on Server 2008 R2 It worked perfectly for me!! This will not work for a domain controller.
Trapper Posted July 23, 2014 Posted July 23, 2014 Ok - is your Anti-Virus or backup provided by your LEA? AV and backup service accounts are normally domain admin accounts. If your LEA is anything like Service Birmingham the default username/password will be the same across the authority. For example if you use Sophos AV provided by your LEA ask them for the default service account credentials (or even look on their support portal). If they need the Head to email them, then ask them. Do you use Ranger? Is there a Ranger account? Normally most networks have at least a couple of service accounts that require domain admin to read/install what is required. This could be a way in, assuming the support company hasn't denied logon to service accounts in GP!
FN-GM Posted July 23, 2014 Posted July 23, 2014 AV and backup service accounts are normally domain admin accounts. They are not normally domain admin accounts. They should never ever be domain admin accounts, its bad practise. I would be surprised if they do use domain admin accounts.
mtillbrook Posted July 23, 2014 Posted July 23, 2014 This will not work for a domain controller. I've done it on a DC before and it did work
Firefox Posted July 23, 2014 Posted July 23, 2014 They are not normally domain admin accounts. They should never ever be domain admin accounts, its bad practise. I would be surprised if they do use domain admin accounts. What if you're wanting to manage AV and backups of a DC, and these applications require local admin rights? How do you provide this on a DC without making it a Domain admin?
Trapper Posted July 23, 2014 Posted July 23, 2014 They are not normally domain admin accounts. They should never ever be domain admin accounts, its bad practise. I would be surprised if they do use domain admin accounts. Tell Service Birmingham that. Not only is it their practice, if you spend ages playing around with permissions for their backup account and remove it from domain admins, they put it back and tell you it's unsupported.
jimbopembo Posted July 23, 2014 Author Posted July 23, 2014 Hmmm sophos Enterprise supplied by Lancashire could could be on it.
Marshall_IT Posted July 23, 2014 Posted July 23, 2014 I can't remember the exact bus but watch this, Ten Deadly Sins of Administrators about Windows S…: http://youtu.be/wo7o81VhvVA well with watching anyway, I think it's in this video but might be another of hers. There should be something in there you can use. 1
MatthewL Posted July 23, 2014 Posted July 23, 2014 Install the admin tools in a client and check who else is a member of domain admins, also you can check what the username is then.
rob_coles Posted July 23, 2014 Posted July 23, 2014 I had the same problem a few years back, Offline Windows Password & Registry Editor to change the "local" admin password followed by Forgot the Administrator's Password? - Change Domain Admin Password in Windows Server 2003 AD « Petri Petri
jimbopembo Posted July 28, 2014 Author Posted July 28, 2014 I can't remember the exact bus but watch this, Ten Deadly Sins of Administrators about Windows S…: Ten Deadly Sins of Administrators about Windows Security - YouTube well with watching anyway, I think it's in this video but might be another of hers. There should be something in there you can use. This has worked a treat. I created a WinPE bootable and added the appropriate RAID drivers, and followed the presenters instructions. Its deadly sin number 9 about a third of the way in. Definitely worth watching.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now