AD administrator password - Modern ways

[CAWJames]

Good morning all,

 

We have an insecure admin password for AD, as in generic word of mouth between IT team password.

 

We are looking into modern methods of making this more secure, as in 2 factor etc.

 

We want something that can be used easily at desktops and RDP to servers etc.

 

What do others user? Just a suitably complicated passwords or RSA or DUO or YUBI etc

 

Thanks

 

James

[Norphy]

I think the recommended course of action is:

 

1) Disable the Administrator account

2) Give IT staff two accounts: a daily driver with standard access rights and an account with admin privileges for the domain which can be used to log onto servers with and for tasks which require elevated permissions.

 

That way, you all have your own accounts, auditing and accountability are still there and there is less chance of a weak administrator password being leaked.

[denzal2k4]

Yeah sure that's how you're *SUPPOSED* to do it, then we get those bits of software that have to be run on the server from the admin account it was set up with and things get awks.

[RobD]

Yeah sure that's how you're *SUPPOSED* to do it, then we get those bits of software that have to be run on the server from the admin account it was set up with and things get awks.

 

Yep, use service accounts with least amount of access needed. Its a pain but I'd say the correct way to do it in my opinion.

[korifugi]

I think the recommended course of action is:

 

1) Disable the Administrator account

2) Give IT staff two accounts: a daily driver with standard access rights and an account with admin privileges for the domain which can be used to log onto servers with and for tasks which require elevated permissions.

 

That way, you all have your own accounts, auditing and accountability are still there and there is less chance of a weak administrator password being leaked.

 

THIS.

 

We do this and it works perfectly fine - there's a slight change in working practice as you get used to elevating privileges rather than just 'doing stuff' with your normal account, but it's quite a good solution (and as stated adds accountability for which change was made by whom).

[jthompson]

We have accounts set up similarly to how @Norphy has described.

 

We also use KeePass, which has a nice 'autotype' feature (essentially it autotypes username, tab, password, enter). This works for RDP login prompts, so your admin password(s) can be nice and complex. It's available as a portable app, so it can be run from a network share.

 

If you use an RDP client like mRemoteNG on your main workstation, your various RDP connections can also have credentials stored right in the config.

[TechMonkey]

Yep, what Norphy and RobD say. Add LAPS to make sure the Local admin password is random and secure. We use LastPass so any password can be shared if necessary and we could share it with other people without them knowing what it is.

 

We've looked at Duo but it could have become quite expensive and do we really need 2FA on internal machines? We have implemented 2FA on Azure accounts and Google administrators. The issue we have found there is a lot of services that tie in need a Global Admin account and don't work nicely with 2FA, there needs to be a way to give the account lower access or non-interactive login.

[Arthur]

Yep, use service accounts with least amount of access needed.

+1. Also worth mentioning are Group Managed Service Accounts.

 

https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

 

A standalone Managed Service Account (sMSA) is a managed domain account that provides automatic password management, simplified service principal name (SPN) management and the ability to delegate the management to other administrators. This type of managed service account (MSA) was introduced in Windows Server 2008 R2 and Windows 7.

 

The group Managed Service Account (gMSA) provides the same functionality within the domain but also extends that functionality over multiple servers. When connecting to a service hosted on a server farm, such as Network Load Balanced solution, the authentication protocols supporting mutual authentication require that all instances of the services use the same principal. When a gMSA is used as service principals, the Windows operating system manages the password for the account instead of relying on the administrator to manage the password.

 

Using a gMSA, services or service administrators do not need to manage password synchronization between service instances. The gMSA supports hosts that are kept offline for an extended time period, and management of member hosts for all instances of a service. This means you can deploy a server farm that supports a single identity to which existing client computers can authenticate without knowing the instance of the service to which they are connecting.

[computer_expert]

Yep, what Norphy and RobD say. Add LAPS to make sure the Local admin password is random and secure. We use LastPass so any password can be shared if necessary and we could share it with other people without them knowing what it is.

 

LAPS is great for workstations & member servers, but please don't install it on a DC unless you want to lock yourself out of the domain administrator account (like I did when testing on a test DC/Domain!)

[Katy]

LAPS is great for workstations & member servers, but please don't install it on a DC unless you want to lock yourself out of the domain administrator account (like I did when testing on a test DC/Domain!)

Shouldn't happen if you've got your own named admin account though, as it just alters the builtin administrator account password.

[MatthewL]

2 accounts, normal user for day to day work, admin account for other, any services each have own account.

 

Always work to the least permission principle, might be a pain at first but a good habit to get into.

[mavhc]

Would be better if you could quickly switch between 2 accounts, like the multiple desktops feature but with different users on each desktop. So much stuff I do relies on being a domain admin it's a pain to switch back and forth

[Arthur]

Would be better if you could quickly switch between 2 accounts, like the multiple desktops feature but with different users on each desktop.

You could do that with a VM. i.e. have your PC logged in with a standard user account and then use the VM for things that requires higher privileges.

 

https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations