Domain Admin Password Change

[ITGURU]

Having inherited networks and admin passwords, is there a way to be able to audit where the main administrator password may be entered in manually?

I could just change it and see what breaks, but wondered if there was any way to know where might be manually input into services, scheduled tasks , server applications etc,

Thanks.

[MatthewL]

I'd change the password and see what breaks, you can always change it back whilst you fix things?  I'd be creating service accounts for everything then its more secure.

[ITGURU]

That's what i have been doing for a while at other sites. Just this site to sort 🙂

 

[KK20]

the microsoft way (without third party tools) is windows audit policy and log checking for events.

[ITGURU]

No adverse effects so far with the change having updated in locations I can think of where hardcoded in. I.e task scheduler 

[k-strider]

ive been in my school for 20 years but i did have to do this about 5-8 years ago i just had to change the pwd and work out what didn't work (which would have been stuff i setup)... then i screenshot everything i hens fixed.... but as others said if too much stuff breaks just change it back until the holidays or the like when you can spend time working it out.... My guess it will mostly like you said be scheduled task stuff on servers... i was looking at my doc the other day it had Entra Sync, Google Sync, Newtrix password expiration they were the things that had the admin creds stored.

[Davit2005]

I'm a stickler for using specific service accounts and only giving them accounts the access they need. With the right permissions a domain admin account should not be needed much at all. Certainly not for day to day stuff.

 

I'd also create elevated accounts for IT admin which they use for IT admin tasks.

 

You might be able to check in logon event viewer where the domain account is/has been used.

Edited December 12, 2025 by Davit2005

[Rob_D]

10 hours ago, k-strider said:

but as others said if too much stuff breaks just change it back until the holidays or the like when you can spend time working it out....

Even if you try and get everything sorted during the holidays, I'd still plan for a bunch of stuff to not be working on the first day back, as there's always those things that don't show up until the teachers start trying to do stuff.

[MatthewL]

Totally agree with the above (Davit2005).

Edited December 12, 2025 by MatthewL

[KK20]

I posted something similar in another thread, I use gMSA instead of traditional scheduled task privileged users.  Takes the headache out of password rotation.

[nicholab]

Also, the KDC password needs to be changed AD Forest Recovery - Reset the krbtgt password | Microsoft Learn.  If worth running Home - PingCastle and locking at the AD security report.

[FN-GM]

On 12/12/2025 at 09:02, k-strider said:

I was looking at my doc the other day it had Entra Sync, Google Sync, Newtrix password expiration they were the things that had the admin creds stored.

 

You should never use Domain Admin for this. Domain Admins should only be used to login to a DC.

[nicholab]

So your suggestion 3 account for every domain you administrator?  User, admin and domain admin?

[DrCheese]

5 hours ago, nicholab said:

So your suggestion 3 account for every domain you administrator?  User, admin and domain admin?

 

We have 4...

• User
• Workstation Admin
• Server Admin
• Domain Admin.

We tried to make do without a workstation admin for a while & just use LAPS for local, but it was a bit too far.

 

Not a big headache when you have something like 1password.

Edited December 14, 2025 by DrCheese

[jmak]

7 hours ago, DrCheese said:

 

We have 4...

• User
• Workstation Admin
• Server Admin
• Domain Admin.

We tried to make do without a workstation admin for a while & just use LAPS for local, but it was a bit too far.

 

Not a big headache when you have something like 1password.

As above, plus admin account for M365 cloud which is separate from the global admin account (standard use account is SSO with domain account).

[DrCheese]

2 hours ago, jmak said:

As above, plus admin account for M365 cloud which is separate from the global admin account (standard use account is SSO with domain account).

 

Ah yes forgot that one also!

 

365 admin accounts are also separate, so 5 😛

[Davit2005]

On 13/12/2025 at 10:18, FN-GM said:

 

You should never use Domain Admin for this. Domain Admins should only be used to login to a DC.

Entirely, create a service account with the rights needed for the purpose. It is the same with LDAP/S auth methods i.e. any service that authenticates users by LDAP/S, should not need domain admin, jus a domain user account will normally suffice, a dedicated AD account per use so you know where it has been used.

Edited January 5 by Davit2005