What breaks once you changed the admin password!?

[abillybob]

Hey Guys

 

So I'm leaving very soon and the deputy has asked me to come up with a list of what will stop working correctly once the new technician changes the Administrator password. Is anyone able to give me a brief outline of various services that won't work or respond anymore once this is done? For example will DNS be ok?

 

Thanks

abillybob

[Boredguy]

Have you setup any scheduled tasks that run as the domain administrator?

 

DNS etc won't matter as it's running as a service not as the administrator account.

[elsiegee40]

The backups usually - scheduled task

[localzuk]

Scheduled tasks are the main thing. Some software that is badly configured (some installs end up with services running as domain admin, for example). Any software packages that connect in to LDAP/AD that use the admin account (eg. if a NAS has been linked to AD, sometimes they've been set up using the domain admin as their auth account). Backups too.

 

However, ideally all those things should be moved to dedicated accounts for each!

[Joanne]

When I changed the password here the only thing that was affected was scanning facilities on the photocopiers.

[dry]

Half the bloomin' network if you are at my school and inherited what I inherited! Grr

 

"Oh, can't be bothered to image this laptop nor join it to the domain, nor create an account for this person so I'll just map various network drives and printers using an admin account" (is what my predecessor must have been saying half the time)

[abillybob]

Cheers peeps think it's just going to be the backups, smooth wall and scanning on the printers that will need fixing then!!!

[kennysarmy]

Hey Guys

 

So I'm leaving very soon and the deputy has asked me to come up with a list of what will stop working correctly once the new technician changes the Administrator password. Is anyone able to give me a brief outline of various services that won't work or respond anymore once this is done? For example will DNS be ok?

 

Thanks

abillybob

 

Why will he "need" to change the administrator password?

[Joanne]

because @abillybob is a total hacker innit!

[Tesla]

When we changed password here it was backups and scanning facilities too, though scan one took me a couple of days to work out as it wasnt reported for a good while after!

[pantscat]

Nothing should break really, if it's all been setup properly.

 

But... check scheduled tasks, check what accounts services are set to run as, and check what credentials your backup systems use.

 

All of these things should use dedicated accounts...

[datar_]

Assuming that the Unattended script for WDS uses your admin password, that'll stop imaging unless you change it

[twin--turbo]

Nothing to a whole heap.

 

trap and log all authentication events for the domain admin. Find what has logged on and fix it.

 

some events may bee weekly, monthly or less often ( even manual ).

 

So tread carefully.

 

TT

[garethEds]

Just change it and cross your fingers - then fight the fires and blame everyone else :-)

 

Gareth

[elsiegee40]

Just change it and cross your fingers - then fight the fires and blame everyone else :-)

 

Gareth

 

Let them change it after you have gone

[twin--turbo]

Once it is changed to a long complex password, never use it again.

 

Put it in a sealed envelope signed on the seal by two senior staff and then have it put in the school safe. Change the password once a year.

 

Then start ratcheting down on the other domain admin accounts so they are reduced and don't use Domain Admins as day to day accounts.

 

TT

[datar_]

Let them change it after you have gone

 

I actually let this happen once, as I was some what disgruntled... New Head... Hearing reports of broken things made me slightly happier.

[elsiegee40]

Well what's the point of you changing it before you leave? You still know it. Your successor will still have to do it. Admittedly you'll be able to warn them what's going to break

[MrFrostmaul]

Is there any way to do an audit to see what is using the administrator account as I am wanting to change our password here (been same for many many years and many people who have left knew it)?

[twin--turbo]

yes monitor event logs on the DC's for admin account logins. there are various tools that will collect the logs for analysis.