Changing Domain Admin password

[ITGURU]

If I want to change the domain administrator password is there any way to determine what services or programs are using the password?

Over the years I've setup unique AD users for some services and systems but having Inherited the network there will probably be scheduled tasks or other software which is using the domain admin account.

Is it a case if change it and see what breaks or a way to audit where the account might be used on the network?

Thanks.

[dmartin1018]

Sounds strange but it is actually a good thing if it breaks things. The domain Admin account shouldn't be used to authenticate services/apps for security reasons. If something breaks once you've changed the domain Admin password then you can use the opportunity to set up a dedicated service account.

[dmj]

Read the log files

[HPlum78]

@dmartin1018 has suggested would find the things that are using the account with a few MI's along the way, and as succinct as @dmj has put it it's not wrong. Thing is just changing the password will not surface all the use cases as quickly as you may expect due to token life span and such like and some stuff you may find only on a reboot or when you really don't want to find out! The answer is probably somewhere in between you may need to ramp up your logging on your DC's and extend the time before they wrap so you have time to do some analysis.

[kmount]

And pay attention at the next patch reboot when services start up and bind etc.

[Wubbalubbadub]

Sounds strange but it is actually a good thing if it breaks things. The domain Admin account shouldn't be used to authenticate services/apps for security reasons. If something breaks once you've changed the domain Admin password then you can use the opportunity to set up a dedicated service account.

This...

[jthompson]

Have a look at the list Scheduled Tasks and the list of Windows services for each server to see what user accounts they're all using. Should be easy enough to spot and change things before you go changing the password.

[Roberto]

Run something like the powershell below on each server?

 

Get-WMIObject Win32_Service | Where-Object {$_.startname -ne "localSystem" }| Where-Object {$_.startname -ne "NT AUTHORITY\LocalService" } |Where-Object {$_.startname -ne "NT AUTHORITY\NetworkService" } |select startname, name

 

Of course this won’t catch everything, if someone app starts under local service but stores your domain admin creds internally for its own use, you may have run with that.

Edited July 5, 2020 by Roberto

[HPlum78]

If services/ applications are set to use an account to run then you should set up an account for each of those ideally. Have a naming convention for those like SA_ and the report on those, even better would be to use GMSA if your applications can support them, and none of these should be in any kind of privileged group's (Domain admin, Enterprise Admin). Just like your admin accounts for that matter, if they are get them out of those groups.

[psydii]

I just* completed iterating through all our servers checking services and scheduled tasks. Don't forget to check any services that push clients onto devices - These could be using DA creds too. It really wasn't as bad as I expected. VEEAM and SCCM being the biggest pieces that needed unpicking.

 

 

 

*Six months ago.

Edited July 6, 2020 by psydii
Wow where has this year gone....?

[box_l]

http://www.cjwdev.co.uk/Software/ServiceCredMan/Info.html

[dubsdj]

I just change it and normally you can tell pretty quickly what stops working. Best to use service accounts in most cases.

[Davit2005]

Also check if you use MDT/SCCM what account is been used to join the clients to the domain after deployment.

 

A word on this subject, this account does not need to be a domain admin and that can be a security risk if you do. You can set a service account and give it delegated permissions just for the task of adding domain PCs to a specific OU and then specify the service account and OU in the deployment task.

 

Many services that use LDAP also do not need to be domain admins as they just need a domain user account to verify the credentials of users from the AD servers.

Edited July 16, 2020 by Davit2005

[mavhc]

Set the netlogon servers to audit logon events