GPO for Local Admin Accounts

[Gilly2003]

Hi all,

 

Does anyone know whats the best way to deploy a local admin account throughout your domain?

 

Obviously when I Google it, answers point to a GPO with Computer config > preferences > control panel > local users and groups however I have read many comments below these articles stating that Microsoft patched this approach due to security (plus I tried it and it doesn't work)

 

Any help would be greatly appreciated

[PotNoodleTech]

That's what we're using here seems to work fine on Windows 7?

[Domino]

LAPS! https://www.microsoft.com/en-us/download/details.aspx?id=46899

 

And abutters, if you're setting the password through GPO theres a massive security hole there: https://support.microsoft.com/en-us/kb/2962486

[Gilly2003]

So in short, LAPS must be installed on all domain computers/laptops/servers and managed through a singular install on the primary DC?

 

My problem is I don't have a deployment server to run a site install

[Steve21]

You can use GPO no problem, we do that here

 

*Edit - Do you mean add a local admin? e.g. Set a domain user to local admin, or change/create local admins?

 

Edit 2 - As an example, we have a Technicians group in AD that's set to local admin via GPO

 

Steve

Edited August 12, 2015 by Steve21

[PotNoodleTech]

Ah - oops, I am not deploying a username and password through group policy, I am just elevating an existing domain user as a member of the local Administrators group. No passwords stored.

[computer_expert]

The LAPs installer can be deployed via Group policy software deployment (as it's an MSI installer). Pop the installer onto a network share that all PCs have access to and create a new GP setting to deploy the installer (and configure the LAPS group policy settings)

[KLashbrook]

You can use the Restricted Groups policy in a GPO to add a domain group to the "Local Administrators" group on the machine receiving the GPO.

There are two modes of the Restricted Groups policy in a GPO: Accumulative or Enforced.

 

That's the old-school way... now you can use GPP to do the same thing.

[Gilly2003]

Yes I'm looking to create a local user with administrator rights on all domain devices so LAPS seems to be the best bet

 

Thanks for the help guys :)

 

Much appreciated

[ITGURU]

Local Users are set by GPO here,

Local Administrator account is kept disabled.

New Local user is created as an administrator account with password and assigned to the local 'Administrators' Group.

Also add in our IT Support users security group so if one of my techs were to login to the PC they would get admin rights.

 

Should there be any password breaches, just change in GPO and PCs will pick up new settings at next reboot.

[Domino]

Local Users are set by GPO here,

Local Administrator account is kept disabled.

New Local user is created as an administrator account with password and assigned to the local 'Administrators' Group.

Also add in our IT Support users security group so if one of my techs were to login to the PC they would get admin rights.

 

Should there be any password breaches, just change in GPO and PCs will pick up new settings at next reboot.

 

And that method is trivial to get the password from: https://technet.microsoft.com/library/security/ms14-025?f=255&MSPPError=-2147217396

 

Anyone with the password then has admin access to any and all machines, and until malicious access is confirmed that won't change.

 

LAPS is a much more secure solution.

[ITGURU]

And I would be the first to know if the account was used, as my logon/log off tracking scripts include ALL user accounts, so a simple check of the text file would instantly make me aware if was used.

 

If wanted to go one step further, I could get the event log to email me every time the admin user account was used, including the master Administrator account.

 

I did this previously when students were trying to guess the supply staff login, as they were a bit surprised to track them down to the computer they were attempting to log in to.

 

 

 

And that method is trivial to get the password from: https://technet.microsoft.com/library/security/ms14-025?f=255&MSPPError=-2147217396

 

Anyone with the password then has admin access to any and all machines, and until malicious access is confirmed that won't change.

 

LAPS is a much more secure solution.

[Domino]

And I would be the first to know if the account was used, as my logon/log off tracking scripts include ALL user accounts, so a simple check of the text file would instantly make me aware if was used.

 

If wanted to go one step further, I could get the event log to email me every time the admin user account was used, including the master Administrator account.

 

I did this previously when students were trying to guess the supply staff login, as they were a bit surprised to track them down to the computer they were attempting to log in to.

 

And if it was malware?

[Domino]

Also, if you've been patching your Domain Controllers, you can no longer save the password in a GPO - it's what the update from the CVE above disables

 

[ITGURU]

If malware, then whether or not the local admin user account was set by GPO or manually, it could still access the local accounts.

 

All servers are patched with all windows updates, and to be honest, I've not had to change the password in the last 3 years so not noticed it's disabled.

[Domino]

If malware, then whether or not the local admin user account was set by GPO or manually, it could still access the local accounts.

 

yes, but under your current method it now has access to an admin account on all machines

 

All servers are patched with all windows updates, and to be honest, I've not had to change the password in the last 3 years so not noticed it's disabled.

 

Right, so now in the event of a breach you can't change all the passwords with a GPO.

 

LAPS is the solution for this.

[ITGURU]

in that case, if there is ever the necessity for it to be changed, I can look into LAPS.

 

yes, but under your current method it now has access to an admin account on all machines

 

 

 

Right, so now in the event of a breach you can't change all the passwords with a GPO.

 

LAPS is the solution for this.

[ITGURU]

Is LAPS just for the built in Administrator account?

 

Say for instance you have laptops which won't log on because they've lost the wireless network or adapter disabled and you need log on local to re-connect. Is it still possible have a different local admin account set and all clients have the same password?

[Domino]

You can name an account in the LAPS ADMX GPO settings. Create it with GPP and have LAPS manage the password

 

They won't have the same password, the password is stored in AD

[ITGURU]

You can name an account in the LAPS ADMX GPO settings. Create it with GPP and have LAPS manage the password

 

They won't have the same password, the password is stored in AD

 

So if we had to logon to a PC locally, we'd have to find out what it is and remember it before we went to the PC? So in effect having to remember a different password for each client?

[Domino]

Yes. That's by design. So Anyone gaining a local password through a vulnerability doesn't immediately have admin access to every machine.

[ITGURU]

Yes. That's by design. So Anyone gaining a local password through a vulnerability doesn't immediately have admin access to every machine.

 

Whilst that may be good security - if you get called to a classroom of 30 kids and 5 cannot connect, then you can't just login with the local admin that has been created to re-connect the wireless, your saying you would have to go away, find what the admin password is, then log in to sort - what a palava!

[Domino]

You could automate an export of the passwords via a powershell script to a CSV into {password manager of your choice} then look it up on your phone whilst there?

[ITGuyWestMidlands]

Doesnt need to be a local admin. A local user will have permission to enable wifi

[Roberto]

Whilst that may be good security - if you get called to a classroom of 30 kids and 5 cannot connect, then you can't just login with the local admin that has been created to re-connect the wireless, your saying you would have to go away, find what the admin password is, then log in to sort - what a palava!

 

If you think that's bad you should see what happens if a student finds out the local admin account credentials on one machine and realises it works on every other machine in the domain...