Local admin User policy

[Checkmate1984]

Hi All

 

whats your policy to create a local administrator on a newly imaged workstation.

 

Here i have seen some machines have no local admin accounts, one that do have a encrypted password that's generated by some back end software so users never login to a machine locally

 

Had instance where a workstation had trust relationship issue. Simple fix is put in work group and back in domain but due to above they just re-image the machine which means 90 mins or so wasted

 

I have not worked in schools for past 3 years so have lost touch on latest policies. In past i use to have local admin account created with one password. I know we can roll out local admin via GPO too should this be needed

 

Is this still the norm or is now encrypted password the future??

[Rob_D]

We set the admin account during the MDT build. The password is just changed every year or so.

[DavR]

We have a local admin user that I put in our Win 10 build. It's a non-standard username (ie, not 'admin' etc) and has a basic password on it, so it's about as secure as a network user login.

[rrrrr]

A local admin password should never be shared across devices.

Changing the username from administrator provides little security benefit as usernames are easily enumerated.

Never set by gpo as this is easily decrypted. Shouldnt even be possible now as Microsoft have disabled this feature.

 

Implement LAPS (Microsoft local admin password solution) its the safest way, or completely disable them

[pete]

We use LAPS (https://technet.microsoft.com/en-us/mt227395.aspx) to manage passwords.

 

If you're setting passwords via GPO, any authenticated user can browse to sysvol and decrypt the password. See: https://blogs.technet.microsoft.com/grouppolicy/2009/04/22/passwords-in-group-policy-preferences-updated/ and https://adsecurity.org/?p=2288