Group Policy - Adding Local Administrator Users

[talksr]

I have been working with a primary school for a number of years. They only get me for a short time each fortnight and are fed up of waiting for me to come in so want the administrator password.

The school have asked several times and I have strongly advised against it each time but they are not listening. Their bursar is "good with ICT" so they would like the password. It is just laughable.

Thankfully, the school has increased the ICT support time so now a colleague of mine goes in every other week, so they have someone once per week, but still, they want the admin password.

 

I am not prepared to give it so I figured that the next best thing would be to create local user accounts on every machine on the domain with admin privileges. Then if they really can't wait a few days for us to install something, they can log in and do it themselves.

Can anyone advise if this can be done easily via Group Policy?

 

We are running Server 2016 Standard with Windows 10 client machines.

 

Any help would be great. I am simply not prepared to give out an admin password for the server and see them destroy the hard work we have put in over the years.

[Jcx500]

I would give the bursar a secondary admin account with local admin privilege. We have a technicians group on the domain which gives them local admin privileges. We Run a script what adds them at logon. With the below command

 

net localgroup "Administrators" /add "DOMAIN\Technicians"

[jtotheb]

Can anyone advise if this can be done easily via Group Policy?

 

Define easily? But yes, entirely doable. Take a look and see what flavour you fancy:

 

GPO is via Restricted Groups.

GPP is via Local Users and Groups.

[Davit2005]

Add a domain group to the local administrators group on the PC is my preferred way of doing this. Any sub contractors installing software on local machines could even be added to the domain group which then been a local administrators group very easily and separated from your normal technician group, it stops the need for giving anyone local administrator passwords. I'd suggest on disabling the local built-in administrator account anyway and create a different local admin account.

 

Adding this domain group can be done via Restricted Groups setting in Group Policy.

Edited November 30, 2020 by Davit2005

[paulkerton]

They are entitled to a copy of that password, but it should be stored in a safe location (quite literally a safe) and only be accessed in an emergency, for example, should you be incapacitated in some way.

 

I'd be very wary of them having the passwords to be able to install anything, personally. It's a recipe for ransomware and viruses... Though if you're a company brought into support them, they're absolutely entitled to ask for that information and do what they want to.

[pete]

Though if you're a company brought into support them, they're absolutely entitled to ask for that information and do what they want to.

 

They're entitled to having the password.

 

Whether they can do what they want and still be covered by the support contract is another matter.

 

Most sensible MSP contracts have boilerplate language around "the client running around being an idiot with admin privileges is not covered under this agreement / chargable / grounds for firing the client".

[paulkerton]

Whether they can do what they want and still be covered by the support contract is another matter.

 

Most sensible MSP contracts have boilerplate language around "the client running around being an idiot with admin privileges is not covered under this agreement / chargable / grounds for firing the client".

 

Absolutely agree on that. They should have the password for long-term security purposes, but not for doing things to the system directly and breaking them. If they decide to use it to break things, then that shouldn't then come back on the MSP at all.

Well, unless they want to pay above and beyond for fixes!

[mavhc]

Computer>Policies>Windows>Security>Restricted Groups>add a group to the Builtin\administrators local group

 

Then make localadmin1, localadmin2 etc, and give them out the passwords, 1 to each person who really really needs it. Audit all login events and make them fill in a shared document about who logged in when and where and for what purpose, then match up with your logs to check they're doing it, if not the account gets disabled because the password has escaped.

 

1 localadmin account per person.

 

Main question is what are they trying to do that's blocked, and why? You can probably change the security allow them to do things without admin rights.

[psydii]

So assuming that the answer to @mavhc 's final point is "because of a valid business reason, that cannot be accommodated through out of the box secure defaults"....

 

 

I would recommend this method: https://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/#:~:text=%20%20%201%20Step%201.%20Open%20the,groups%E2%80%9D.%20These%20two%20options%20will%20automatically...%20More%20

. It grants the power to centrally control who has admin on a given machine.

 

We use it for apps that need to run as admin. We create an account on the domain (limited access because "domain users" have no access to any shared folders on our Domain), and add this to the computer admin group in AD. The above config adds it to the local administrators group on the target machine, the end user can then right click on the app icon and runas the "guest"/admin account. IF we wanted to go one further we could use this method to restrict the account to only be able to log on to the named computer: https://www.itsmarttricks.com/restrict-logon-to-specific-computer-in-active-directory-windows-server-2016/

 

We also use it to temporarily grant admin to users when they need it.

Edited November 30, 2020 by psydii

[talksr]

Thanks everyone for your posts.

 

I have been given no examples of why they need the password, they are not even half way through their contact with us, so it is not as though they want a competitor to go onto the server.

 

I am all for letting them bugger up the network and then calling us in as all it will do is create a revenue stream for us, however I am afraid at this point in time with covid etc, I am not prepared to give out a password that would allow them to destroy the network. Much in the same way, if there were a contractor in to do work maybe Paxton Access or similar, we would not give them the main admin password.

 

It is imperative at this point in time, that the ICT infrastructure works and that we can facilitate the learning of the children either in school or out so I will go with the suggestions posted here in terms of allowing one local admin account for one specific person.

 

Once things have settled down in terms of the virus etc, I will discuss with them the matter of the password and re-iterate for the 100th time the implications of them having it and using it.

[jmak]

Really worth asking them what specifically they want to do.

 

Usually it's things like resetting passwords, creating users, installing software/devices. Very few school users actually want to do much more than that. You can give specific users the rights to do that and tell them they have an administrator account (their account DOES have the rights to carry out specific tasks which are pay of the Windows adjustable role, so it's not a complete lie).

 

As an alternative, create administrator accounts for the specific people who the Head says need it, make it a separate account from their standard user account so that they're not using it except when they need it and explain that's what you do too and next time you go, take a printed copy of THE domain admin account in a sealed envelope that have you then laminated closed and instruct them to put it in the safe. Make the password at least 25 random characters. You have then both given them the password they asked for and given them the access they asked for. At the time you hand it over, you can explain that you don't use THE administrator password, so it really isn't needed for anything except as a last resort in an emergency.

[steve]

Add a domain group to the local administrators group on the PC is my preferred way of doing this. Any sub contractors installing software on local machines could even be added to the domain group which then been a local administrators group very easily and separated from your normal technician group, it stops the need for giving anyone local administrator passwords. I'd suggest on disabling the local built-in administrator account anyway and create a different local admin account.

 

Adding this domain group can be done via Restricted Groups setting in Group Policy.

 

We do this. A domain security group (IT-admin-staff) is added to the local admins group across our campus - some exclusions where there are confidentiality or security restrictions. IT operations staff that manage the devices are give a secondary account that is a member of the IT-admin-staff group.

 

This way staff aren't running persistently as admin, they only have admin on the PCs the GPO adds the security group to (no servers), and with individual secondary accounts you still retain traceability.

Edited December 3, 2020 by steve