How do you do it? 1 domain admin acc for everything or different accounts?

[ADMaster]

Here is my source for the plain text screenshot. and an article on gMSAs.

 

I don't have any gMSAs though. It was flagging my sccm admin service account even though its just a standard user with one purpose.

I may have to setup a VM and test cain.

I've removed them from the DA group and waiting to see what breaks.

https://www.dsinternals.com/en/retrieving-cleartext-gmsa-passwords-from-active-directory/

[ADMaster]

I just checked for myself in a VM, don't reuse service account passwords and don't give them ore access then they need. I saw my passwords in plain text.

I think for this to work you need admin privileges to start with but trying to secure everything the best I can.

[mukz]

We have 1 main DC account that only the Systems Admin uses (me) to install stuff on servers - gets disabled once no longer needed.

Noone is allowed to rdp into the servers unless at the console or has the authorised permission to do so aka myself and the other admin

 

We have IT Admin group which allows read access to certain folders and permissions for what is required (DHCP, GPO which is locked down using AGPM, DNS)

 

We have LAPS setup now, whereas before the administrator account was renamed to IT with local admin privileges with a password that was changed every month.

 

We now will be adding a local IT account that we can use to install stuff and troubleshoot (password will change every 4 weeks) - if they are admin machines they will have different permissions and so on.

 

Everything is mostly controlled via SCCM and GPO so our IT Team have no reason to install stuff manually.

[jthompson]

I've now been running for a week or so with my remodeled accounts.

 

Each member of IT admin staff now has:

• Domain admin account. Used for admin work on the servers, with preferably no use at all on client machines.
  
• Computer admin account. Added to local administrators on every client machine (but not on servers). The servers are set to actively refuse logins from these accounts (deny logon locally in Group Policy).
  
• Regular staff account. For web browsing, email, general work, etc. Subject to the same SRP as regular users. Some Active Directory privileges are delegated to these accounts. These are our existing accounts, bumped down from being domain admins to regular Joes.
  

I've also created groups for these three types of accounts, which I'll use when making some adjustments to permissions on shared areas, etc. (that's a job for the summer).

 

I've also rolled out LAPS to all client machines, and will be manually setting unique local administrator passwords for all of the servers (storing those in a KeePass db).

 

There's been a fair bit of fiddly adjustment in the transition (new profiles on the servers mean setting up shortcuts, etc. from scratch) and I've had to work out some new ways of achieving some of the routine stuff when sat at my desk. One of my big concerns with doing all of this was locking myself out of something after taking my existing account's admin rights away, but I started by creating the new domain admin account, and made sure that was working correctly before sorting out the lower accounts. My earlier plan included a fourth account type (server admin) but that turned out to be a lot of complication, with not much real point to it in the end.

Edited July 10, 2017 by jthompson