Change Domain Password

[pbad]

The Head Teacher went to a conference and was given some information regarding a situation in a school where password protocols might have been breached. The document advises the following:-

 

Changing the server passwords

Asking staff to change their personal passwords

Update and review internal policies and procedures

Update the school data protection plan

 

I would like to know what are the implications of changing the domain password. Would the password change break anything such as PCs that have been connected to the domain or any software issues?

[elsiegee40]

It depends how your domain was set up. Was the master domain admin password used to set up everything?

 

It was at my last school. I seem to remember that the main thing that broke was the backups.

[rom1984]

When I started at my place the main thing that used the administrator credentials were the backup. I'd change the password then run a manual backup to see if it backups. If it fails then it uses the admin password. I'd then create a user in AD called backup then configure your backup to use that account.

 

I do this with anything that needs admin credentials so its a good habit to get into.

 

Cheers

[pbad]

It depends how your domain was set up. Was the master domain admin password used to set up everything?

 

It was at my last school. I seem to remember that the main thing that broke was the backups.

 

The master domain admin password was used to setup everything.

[Joanne]

When I changed our admin password the photocopier stopped scanning.

 

Also check any scheduled tasks!

[mukz]

If as elsiegee40 asked everything uses the administrator account, then there is a tool you can download to see where the administrator account is also being used as a service or something else.

 

Cjwdev | Service Credentials Manager

 

I brought it for one of my schools as the previous chap used to use the administrator account to login for everything.

There was no dedicated accounts for anything whatsoever!

[RLR]

We had an admin account which was used for everything. Over the last couple of years we've been updating our services to use their own account. So we have an account specifically for our backup solution, another service account for ldap connections, another service account for syncing etc. This means we can easily change the password on these accounts and know what it will affect and not everything will break when we do update the password.

[rom1984]

These are what I can think of that might use it...

 

Scanning (access to shared drive where the scan saves)

Backup (Backup Software)

 

Text Messaging Services (Think this will just use a Sims account but worth a check)

Staff swipe in software (As per text message service but if it uses Sims it might use the admin password to map your Sims directory)

 

Any staff that log in as adminstrator (hopefully not but I've seen it before!)

 

I can't see it effecting your client PC's unless you have some drives that are mapped that specifically use the admin credentails (i.e I've seen some schools map the Sims drive with the admin credentials or if a staff member has a stand alone laptop the admin might have been a bit lazy and authenticated a shared drive with the admin password for them.

 

I'd give your admin staff the heads up, reset it, then check the the above. Then create indvidual accounts for them and document it.

[Matt_Renato]

Personally I'd setup individual accounts for for everything that is currently using the domain admin account and then switch them over one at a time checking if anything breaks when you do it. It's also a good time to evaluate if anything is using the domain admin account which doesn't need that level of access and tweak the permissions on the individual account(s) accordingly.

[Davit2005]

All accounts should have a minimum access as required. i.e: if a device needs read access to LDAP then their is no need to give them Domain Admin, Service accounts should be blocked from Remote Access to servers, any domain Join scripts for MDT should not be Domain Admins but should be delegated rights on specific OUs.

 

I've seen much bad practice of service accounts being Domain Admins hacked and then used to gain access to other servers, not good.

Edited December 2, 2016 by Davit2005

[pbad]

Thanks to all for your advice. I will take all these recommendations on board.