abillybob Posted January 12, 2016 Posted January 12, 2016 Hey Guys So I'm leaving very soon and the deputy has asked me to come up with a list of what will stop working correctly once the new technician changes the Administrator password. Is anyone able to give me a brief outline of various services that won't work or respond anymore once this is done? For example will DNS be ok? Thanks abillybob
Boredguy Posted January 12, 2016 Posted January 12, 2016 Have you setup any scheduled tasks that run as the domain administrator? DNS etc won't matter as it's running as a service not as the administrator account.
localzuk Posted January 12, 2016 Posted January 12, 2016 Scheduled tasks are the main thing. Some software that is badly configured (some installs end up with services running as domain admin, for example). Any software packages that connect in to LDAP/AD that use the admin account (eg. if a NAS has been linked to AD, sometimes they've been set up using the domain admin as their auth account). Backups too. However, ideally all those things should be moved to dedicated accounts for each!
Joanne Posted January 12, 2016 Posted January 12, 2016 When I changed the password here the only thing that was affected was scanning facilities on the photocopiers.
dry Posted January 12, 2016 Posted January 12, 2016 Half the bloomin' network if you are at my school and inherited what I inherited! Grr "Oh, can't be bothered to image this laptop nor join it to the domain, nor create an account for this person so I'll just map various network drives and printers using an admin account" (is what my predecessor must have been saying half the time)
abillybob Posted January 12, 2016 Author Posted January 12, 2016 Cheers peeps think it's just going to be the backups, smooth wall and scanning on the printers that will need fixing then!!!
kennysarmy Posted January 12, 2016 Posted January 12, 2016 Hey Guys So I'm leaving very soon and the deputy has asked me to come up with a list of what will stop working correctly once the new technician changes the Administrator password. Is anyone able to give me a brief outline of various services that won't work or respond anymore once this is done? For example will DNS be ok? Thanks abillybob Why will he "need" to change the administrator password?
Tesla Posted January 12, 2016 Posted January 12, 2016 When we changed password here it was backups and scanning facilities too, though scan one took me a couple of days to work out as it wasnt reported for a good while after!
pantscat Posted January 12, 2016 Posted January 12, 2016 Nothing should break really, if it's all been setup properly. But... check scheduled tasks, check what accounts services are set to run as, and check what credentials your backup systems use. All of these things should use dedicated accounts... 1
datar_ Posted January 12, 2016 Posted January 12, 2016 Assuming that the Unattended script for WDS uses your admin password, that'll stop imaging unless you change it
twin--turbo Posted January 12, 2016 Posted January 12, 2016 Nothing to a whole heap. trap and log all authentication events for the domain admin. Find what has logged on and fix it. some events may bee weekly, monthly or less often ( even manual ). So tread carefully. TT
garethEds Posted January 12, 2016 Posted January 12, 2016 Just change it and cross your fingers - then fight the fires and blame everyone else :-) Gareth
elsiegee40 Posted January 12, 2016 Posted January 12, 2016 Just change it and cross your fingers - then fight the fires and blame everyone else :-) Gareth Let them change it after you have gone 1
twin--turbo Posted January 12, 2016 Posted January 12, 2016 Once it is changed to a long complex password, never use it again. Put it in a sealed envelope signed on the seal by two senior staff and then have it put in the school safe. Change the password once a year. Then start ratcheting down on the other domain admin accounts so they are reduced and don't use Domain Admins as day to day accounts. TT 1
datar_ Posted January 12, 2016 Posted January 12, 2016 Let them change it after you have gone I actually let this happen once, as I was some what disgruntled... New Head... Hearing reports of broken things made me slightly happier.
elsiegee40 Posted January 12, 2016 Posted January 12, 2016 Well what's the point of you changing it before you leave? You still know it. Your successor will still have to do it. Admittedly you'll be able to warn them what's going to break 1
MrFrostmaul Posted January 12, 2016 Posted January 12, 2016 Is there any way to do an audit to see what is using the administrator account as I am wanting to change our password here (been same for many many years and many people who have left knew it)?
twin--turbo Posted January 12, 2016 Posted January 12, 2016 yes monitor event logs on the DC's for admin account logins. there are various tools that will collect the logs for analysis.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now