Windows Servers - User Logins

[Olliedawg]

Hi all,

 

I'm sure this has been asked before but what are best practices for logging into Windows Servers? I've been on my own for a loong time, i've just been using a generic admin account for logging into all of our VM's & I know thats not ideal anyway.. With an apprentice due to start in a couple of weeks i'm wanting to obviously change this for when they are ready to hop on the MDT VM for example, or our Print VM etc.. I don't want multiple people using the same account.

 

I'm thinking of having their normal user account, which is their daily driver on their machine (no admin access besides local admin on their machine), then having another user account such as admin_%name%, which would have permission to login to the VM's & also have various permissions on those VM's to do their work.

 

What would you do/do you do?

[mavhc]

Question 0: Why are you logging into the server? Most tools can be run remotely.

 

In general the best thing is least privilege. Only computers in this group can even login to the server, and only using accounts that only have the permissions they need. Don't need to be a domain admin, do you even need to be a local admin on the server? Depends what you're doing.

 

Of course that's very annoying and slow to setup and use. So a compromise between "you're the NSA and have a million people who need to login" and "yolo" is required.

 

Consider the threats: 1. mistakes, they break everything. 2. they're evil, they break everything, 3. someone gets their login/password, can they break anything?

 

Start off with secure and limited, increase power once they prove 1 and 2 aren't true. Use actual security for 3, limit connection ability to only this computer etc.

[Oaktech]

At it's most basic, have an an admin account and personal account for each person and tie the admin account down to lowest practical priviliges. Restrict the devices that can connect adminsitratively to a server and try to run as many tools as possible remotely.

[lornebooker]

Our setup has an admin account for each technician in whatever format you prefer the most e.g. adminjd, ITJD or JDA which has Local Administrator on client PC's.

 

Specific permissions for passwords, etc. are then divided up into groups for "User Administrator" "Student Administrator" instead of giving all admins Domain Admin. We also re-use these groups for the select computing teachers who have the ability to reset student passwords.

 

It depends how far you want to dig into it, although I'd definitely recommend separating the accounts. Your normal account should have no admin access and behave as if you were any other member of staff (as frustrating as it can be).