Change domain admin password

[chrbb]

What are the implications for changing the domain admin account password?

[sahmeepee]

As with any account, you may have used it for running bits and pieces on your network, e.g. windows services, scheduled tasks, that sort of thing.

[PiqueABoo]

Exactly, except doing that in the first place is very bad practice.

[chrbb]

I'm being dim now, but I don't know I didn't set the server up:o. How would I find out? All I know is sophos uses it (yes I know bad practice - but I didn't set it up)

[leco]

I'm being dim now, but I don't know I didn't set the server up:o. How would I find out? All I know is sophos uses it (yes I know bad practice - but I didn't set it up)

 

I was going to say your AV but I see you have already sussed that one. When I changed the admin passowrd I just had to keep looking at the event logs to see which bits had stopped working:(

[SYNACK]

The best places to check for this are in the services snapin under the 'Login As' collom and the task scheduler in control pannel on the server. These are the most likely places for stuff like this to be hiding and you would need to re-enter the new password into each of these to keep them going or move them to a different account. Moving them can be tricky though depending on the software as some is hardcoded to allow only the installer user.

[DSapseid]

Also dont forget any backup software that uses it! I changed my password on the domain admin account and forgot about this until i wondered why my backup was finishing inside 1 hour - because it couldnt connect to the other 7 servers!!!

[gshaw]

Backup Exec is a right pain for this with all the logon accounts it keeps asking for

 

Also worth checking SQL Server as well if you have it as I've found a few bits running as domain admin on there that shouldn't be

[witch]

I have to say that I have recently been looking at the same issue and decided not to change it because I really don't know what the impact will be and I am very worried that I will forget something or something will stop and I won't know until it is too late.

[deanc]

we did this a while ago, my reccomendations would be:

 

1) change the admin password

2) restart servers, then check the event log to see which services have failed.

3) reconfigure the services, ideally creating a new admin account for that service (if you really want you could deny them the right to log in interactively)

4) check that all is ok by manually starting the failed service.

 

if everything works ok then your fine, worst case scenario and things go wrong change the password back