How do you do it? 1 domain admin acc for everything or different accounts?

[TwistedHelixis]

This from a primary school perspective and I am the only techie onsite, I also don't need to use the schools systems such as word or email or any of their computers etc, I will simple go in, install or fix something and come out.

 

Until now i have only ever had one account and that has been a domain admin account, and I wondered if others in a similar situation have their accounts setup the same?

 

I do have one other account, a fake teacher account, so I can see how things will work or change for them.

[FN-GM]

We have separate user accounts and separate admin accounts

[TwistedHelixis]

Out of interest, how do you break them down?

 

Not sure if this helps but I have,

Host 1, VM1 is DC, VM2 is data with SQL SIMS, printers etc.

Server 2 is remote access server

Server 3 is iscsi backup server

 

I also need to work on all the school computers / laptops etc.

 

Thanks for you time, I just want to get this right.

[TwistedHelixis]

Would it best to have,

 

a domain admin account that's only used on the DC?

a local admin account for the other servers (SQL, Sims etc) and also use the same account for fixing client computers?

 

Don't forget I am the only one that's going to use these accounts so I want to keep it simple.

[sparkeh]

I have a domain admin account and a normal user account. I run as the normal account and the admin account is only used to elevate privileges when needed.

[TechMonkey]

We have a server account, a pc local administrator account and our every day account. Server and local admin accounts don't have user areas or email accounts.

[rrrrr]

We have separate user accounts and separate admin accounts

 

This is the correct way. Domain admin accounts should only be used when required, not for daily use.

Each team member should have their own accounts for accountability.

If you use local admin accounts for administration, make sure each device has its own unique complex password for this account

[TwistedHelixis]

We have a server account, a pc local administrator account and our every day account.

So is the server account a domain admin account and only used for the dc? or is it also used to update SQL or Sims on the Sims server? or would you update SQL / Sims using the pc local admin account?

[RJohnson91]

I think the best practice is to have an account that you use that isn't a domain admin account but has elevated permissions in areas such as SIMS, of which you use on a daily basis.

 

And having a separate High-level account, domain admin account, that you use only when you need that level of permission.

 

 

If you use a top level, domain admin account all the time, all it takes is a bit of ransomware to hit on a teacher PC when your account is logged in and it'll fly through all shares and network locations with your privileges is seconds.

 

Thanks just my 10 penneth!

[jthompson]

I'm looking at breaking down our admin accounts, in light of the NotPetya ransomware that can spread by lifting admin credentials from one machine to be used on others. I've been meaning to tackle this for a while.

 

This is what I'm thinking. Each individual administrator would have the following set of accounts:

• A domain admin account - used rarely, only when needed (e.g. da_jbloggs).
  
• A server admin account - used when needing local admin rights on servers. Would not have admin rights on regular computers (e.g. sa_jbloggs).
  
• A computer admin account - used when needing local admin rights on regular computers. Would not have admin rights on servers (e.g. ca_jbloggs).
  
• A regular user account - for regular day-to-day use, web browsing, email, etc. (e.g. jbloggs). Would be subject to all the same restrictions as regular staff.
  

 

In addition, I'm thinking that the local administrator account on each server needs to have a unique password. Unique passwords for each computer's local admin is not really feasible.

 

What do people reckon? I've yet to work out the exact groups, memberships and permissions that I'd need for all of these.

Edited June 29, 2017 by jthompson

[Oaktech]

I have a user account. I have a domain admin admin account that is mine by name too.

 

We also have a renamed domain admin account that is the one that gets given to trusted contractors - we used to have an external support company, now it's the one that gets given to our ISP if he needs to do something like modify our directory sync for filtering. It gets disabled when it's not actively being used.

 

No user accounts have any admin permissions local or otherwise.

 

There is a local admin account that gets created on all client machines by WSUS. It's the same for all machines.

 

All servers have a local admin account - it's got the same name for each server but the password is different.

 

We also have single purpose accounts that get created with only the rights they need to function - things like ldap bind for moodle, filtering and copiers. These are named for function and all have randomly generated passwords that don't expire but are stored in an on/offline password manager.

[jthompson]

So if you were administering a machine, but needed access to domain resources (perhaps some tools on a network drive) or access to something that might otherwise be disabled to a regular user account (e.g. cmd or some MMC), what would you sign in with? Your domain admin account or the machine's local admin? Edited June 29, 2017 by jthompson

[TechMonkey]

You can set individual computer admin accounts by using LAPS.

 

Personally I would say the DA as well as the server admin is an extra level of complication. We follow similar lines to Oaktech

[TechMonkey]

So if you were administering a machine, but needed access to domain resources (perhaps some tools on a network drive) or access to something that might otherwise be disabled to a regular user account (e.g. cmd or some MMC), what would you sign in with? Your domain admin account or the machine's local admin?

 

Give all the admin accounts access to a tools or admin share or drive mapping. To run something at an elevated level run the program with elevated permissions.

[TwistedHelixis]

Is there anything I can do to stop staff being local admins? They all have laptops that they also work on from home and removing them from being a local admin was a nightmare as they could not do what they needed while at home. TBH it was also a pain while they were in school as I am only at the primary school for a few hours each week. Things like updating software themselves stopped working or installing that last minute needed app was not possible.

[Oaktech]

So if you were administering a machine, but needed access to domain resources (perhaps some tools on a network drive) or access to something that might otherwise be disabled to a regular user account (e.g. cmd or some MMC), what would you sign in with? Your domain admin account or the machine's local admin?

 

Most software on client machines has the ability to run as admin, so most of the time I just do that. It's worth remembering that just because I don't have an admin account it doesn't mean that I get the same GUI as staff, I see everything, whereas they don't see anything of the control panel, windows updates, standard start menu etc.

 

Rightly or wrongly, I very rarely use the machine's local admin accounts - they tend to be for getting me out of the poop. What usually happens, is the I will sign into a client machine using my ordinary domain account and then RDP the server I need to administer using my DA credentials. This is for 2 reasons - one because auditing then attributes my actions to my domain admin account, secondly I have a GPO applied to all servers (except RDP) that only Domain Admin credentials can be used to sign into them.

 

Likewise for software updates I'll sign into the client machine using my non admin domain credentials, start the update off as my ordinary account and then enter some sort of admin credentials at the UAC prompt. Most of the time these are DA credentials as local admin credentials won't have the rights to download software through the filter.

[jthompson]

Most software on client machines has the ability to run as admin, so most of the time I just do that. It's worth remembering that just because I don't have an admin account it doesn't mean that I get the same GUI as staff, I see everything, whereas they don't see anything of the control panel, windows updates, standard start menu etc.

 

Rightly or wrongly, I very rarely use the machine's local admin accounts - they tend to be for getting me out of the poop. What usually happens, is the I will sign into a client machine using my ordinary domain account and then RDP the server I need to administer using my DA credentials. This is for 2 reasons - one because auditing then attributes my actions to my domain admin account, secondly I have a GPO applied to all servers (except RDP) that only Domain Admin credentials can be used to sign into them.

 

Likewise for software updates I'll sign into the client machine using my non admin domain credentials, start the update off as my ordinary account and then enter some sort of admin credentials at the UAC prompt. Most of the time these are DA credentials as local admin credentials won't have the rights to download software through the filter.

 

That's great, thanks. So, you're basically logging in to clients machines as a non-admin and using UAC to run things as domain admin when needed. When it comes to servers, you RDP in with your domain admin account, with RDP access restricted as much as possible.

 

I think I might go with 3 domain accounts (domain admin, computer admin and regular user). I feel it might be worth avoiding using domain admin on client machines as much as possible.

[TwistedHelixis]

I have ended up going with 3 accounts

 

Domain Admin - just for DC

Standard user - for day to day stuff

Local admin - this is used to elevate software while logged in as standard user

[jthompson]

Is there anything I can do to stop staff being local admins? They all have laptops that they also work on from home and removing them from being a local admin was a nightmare as they could not do what they needed while at home. TBH it was also a pain while they were in school as I am only at the primary school for a few hours each week. Things like updating software themselves stopped working or installing that last minute needed app was not possible.

 

I'm not sure if this answers your question or not, but you can use Restricted Groups in Group Policy (Computer Configuration > Policies > Windows Settings > Security Settings > Restricted Groups) to control which users and groups have local admin on machines. My guess is that one of your GPOs has staff listed there as members of the local administrators group.

 

I made this change a while back, but only after a fair amount of prep work and testing. Previously, our standard image had things like Flash Player and Java installed, but I changed it to a more bare-bones image, with those sorts of things instead deployed via Group Policy as much as possible (I've not explored SCCM yet). In the case of Flash Player, the auto-update mechanism is disabled and we push out new versions by adding them to the GPO, so that staff aren't being prompted to install an update that they can't actually install. All of that took a bit of time to sort out before finally removing staff admin privileges. I had to draw on all my diplomatic skills to get staff on-board with the change. We don't see too many requests for software these days, and we don't see things like Ask toolbar or dodgy YouTube downloaders anymore, which is a delight. Sorry for heading off-topic.

[TwistedHelixis]

Thanks @jthompson. My question was more inline with your second answer, as I know how to add or remove users from local admin groups in gpo. I just cant a) get staff on-board b) have the time at this school to install software for everyone or install updates for them. c) what about when they are at home and cant do something like add their new printer.

 

Wish I could see a way through this.

[TwistedHelixis]

Would be handy if I could add a software elevated account that the staff don't get to see the username but simply type a password. When I tested a teacher using a standard account but using elevated perms when needed, I found out they simply started logging in as the elevated user - noooooo

[jthompson]

Would be handy if I could add a software elevated account that the staff don't get to see the username but simply type a password. When I tested a teacher using a standard account but using elevated perms when needed, I found out they simply started logging in as the elevated user - noooooo

@TechMonkey's suggestion of LAPS looks good. I've never come across it before, but will definitely investigate. With that, you could presumably hand out a local admin password to a member of staff for some agreed upon purpose (e.g. adding a home printer), and then schedule it to be changed after a day or so. You wouldn't need physical access to their machine and if they use it beyond what you agreed, you put a dirty mark against their name.

[ADMaster]

There is a GPO that will allow users to install device drivers of the types you choose.

https://technet.microsoft.com/en-us/library/cc725772(v=ws.11).aspx

 

This doesn't always work and they end up bringing in the CD for me to install.

 

I am working on setting up different admin accounts too and figuring out the best way to elevate.

 

I have powershell scripts the create / disable users every day, I guess create a job specific account?

I read service accounts are stored in plain text?? What permissions do I need to give my sccm / vmm service accounts?

 

Anyone use PDQ inventory, its my go to tool. I launch remote support, pull event logs, launch client center etc. How much of this will break if I'm a standard user?

[TwistedHelixis]

I read service accounts are stored in plain text??

 

Great - our LA setup some service accounts using domain admin groups - I just give up

[TechMonkey]

@TechMonkey's suggestion of LAPS looks good. I've never come across it before, but will definitely investigate. With that, you could presumably hand out a local admin password to a member of staff for some agreed upon purpose (e.g. adding a home printer), and then schedule it to be changed after a day or so. You wouldn't need physical access to their machine and if they use it beyond what you agreed, you put a dirty mark against their name.

 

I'd be careful with that idea. LAPS is an admin tool to secure the local computer admin and help stop people setting the password via GPO, which was in plain text. I guess it could be used like that but it would give them the top level admin account on that PC for the period of time.