Kids discovered the administrator password

[zag]

I've recently found out some of the kids in our school have discovered the administrator network password.

 

What's the easiest way to track when the administrator logs in and out? Are there any 3rd party tools available that make it easy to see?

 

I can just change the password, but I would like to have an idea who knows it, where they are logging on and how widely it is available.

[SC-UK]

For a start, although it would be nice to know who it is, I would get the password changed ASAP!

 

So much damage could potentially be done to your network unless you do.

[maniac]

Change it, straight away without fail or someone else will and lock you all out the system!

 

If you turn on Account auditing, you can trace where and when people login. By default I think it only logs failures, but you can turn it on to log sucesses as well.

 

Mike.

[ahuxham]

If your policies are enabled you can track "Audit: Logon Success" through Event Viewer and see everywhere Administrator has successfully logged in.

[OutToLunch]

Someone else may point out a horrible repercussion to this but if you're determined to catch them logging on, turn on auditing then create a second account with domain admin privileges and a new password and temporarily remove the administrator account from the domain admins - they'll still be able to log on with it but not do anything 'exciting', which will give you time to sneak up and hit them with LART.

[AngryTechnician]

I would actually do the reverse: rename the original Domain Admin account (something which is good practice anyway) and then create a new dummy account called Administrator. You could then customise this account to perform any action you want at logon via script... for example, silently sending you an email saying "I've just logged on at %COMPUTERNAME%"

 

http://caspian.dotconf.net/menu/Software/SendEmail/

 

Going forward, I would have a think about use of the master Administrator account. Personally, I almost never use it, ever. Anyone who requires admin access (including myself) has their own individual account which is a member of the Domain Admins group. This not only improves accountability, but ensures your master Administrator account is much less exposed, since it is not regularly used.

Edited February 8, 2010 by AngryTechnician

[plexer]

Poosibly also look towards 2 factor authentication when logging on to clients as domain admins Yubico looks like a cheap enough solution for this.

 

Ben

[p858snake]

If you turn on auditing, turn on more than just log ons, see what else the little ones are doing in the account.

 

Set a bright fluro background and if you have speakers in your computers you could script the setvol tool and have some audio play on login.

[SYNACK]

I would actually do the reverse: rename the original Domain Admin account (something which is good practice anyway) and then create a new dummy account called Administrator. You could then customise this account to perform any action you want at logon via script... for example, silently sending you an email saying "I've just logged on at %COMPUTERNAME%"

 

Software :: SendEmail - Send email with this free command line email client

 

Going forward, I would have a think about use of the master Administrator account. Personally, I almost never use it, ever. Anyone who requires admin access (including myself) has their own individual account which is a member of the Domain Admins group. This not only improves accountability, but ensures your master Administrator account is much less exposed, since it is not regularly used.

 

+1 - this is exactly what I would recommend, that way you get to catch the offenders and secure the network.

[zag]

Cool, see my problem is I know the boys who have access, but I can't prove it yet. I need evidence before it can be taken further.

 

They apparently found it out via offline files leaving a copy of text file that has a technicians account details in. The file was RAR and Office passworded but they still cracked that. I didn't even think it was possible to break strong RAR passwords but you live and learn.

 

I'm more interested in the process they used and the availability of the credentials around the school at the moment. I will do the dummy administrator thing, sounds like a great idea.

[Michael]

To be honest I would forget about who worked out the password and focus on restoring security. Quite rightly as others have said, you could become locked out of the network and getting back in would prove to be a right hassle!

 

In Active Directory copy the administrator account and name as appropriate. For example call it eduadmin, or whatever you like. Now specify a ridiculously complex password of 20 characters and most importantly, disable the administrator account itself. Now enable Audit logging for failed logon attempts.

[gjdb]

rar passwords can also be cracked, it just takes a little longer.

Atleast you`ve learned not to put any password in a text file

 

All our admins do have a 'normal' user account with some elevated rights and a 'real' admin account which only works on 1 pc in their own office/room.

All domain admin passwords and other important passwords are securely locked away in a safe and almost never used, just to prevent things like this.

[zag]

All our admins do have a 'normal' user account with some elevated rights and a 'real' admin account which only works on 1 pc in their own office/room.

 

How do you lock down the full admin account to one pc?

[zag]

For anyone who is interested I implemented some of the recommendations in this thread

 

- Renamed the administrator account to admin and changed the password(thinking about disabling this at some point)

- Created a new account called administrator, giving it normal teacher access rights

- Created a batch file that emails me when the account logs on, apply this as a script in group policy

- Changed password of any other admin accounts (also have policy now to change them once a term).

- Removed any reference to the accounts from files on the network

 

Here is the batch file if anyone is interested, it uses bmail which works on windows.

 

\\serverlocation\scripts\bmail.exe -s mailserver -t [email protected] -f [email protected] -b "::Warning:: Administrator has just logged on at [%computername%]"

 

I had to also allow the local IP subnet on my smtp server so it can email from anywhere inside the domain.

 

Now I hopefully just sit back and wait for them to bite

Edited February 9, 2010 by zag

[Flakes]

rar passwords can also be cracked, it just takes a little longer.

Atleast you`ve learned not to put any password in a text file

 

All our admins do have a 'normal' user account with some elevated rights and a 'real' admin account which only works on 1 pc in their own office/room.

All domain admin passwords and other important passwords are securely locked away in a safe and almost never used, just to prevent things like this.

 

theres a bug in an old version of winZip that allows you to change the password on zip/rar files without having to know the old password, i used it quite a few times... you could goto "change password" type something random in for "old password" then type in the new password you want to use click ok, and then use the password you just set to open the RAR or zip. surprised no one picked up on it, ill have to dig out the cd its on...

[JJonas]

theres a bug in an old version of winZip that allows you to change the password on zip/rar files without having to know the old password, i used it quite a few times... you could goto "change password" type something random in for "old password" then type in the new password you want to use click ok, and then use the password you just set to open the RAR or zip. surprised no one picked up on it, ill have to dig out the cd its on...

 

Which old version of Winzip?

[Rydra]

The best option I can think of, is to create an account(s) that has LOCAL admin priviledges, which can be used for installing programs on local machines, but not have domain admin access.

 

Then have a seperate domain admin account(s) which can do all the fun stuff you do on domains, but only use it on your server/specific station.

 

This way, even if the kids discover the 'admin' account, they won't be able to cause too much trouble on your network, only install silly apps on the local machines. This is annoying, but not catastrophic, and easily fixable.