Disposable admin passwords

[dalsoth]

Hi All

 

Anyone come across any software that will allow a disposable local admin password on a remote laptop/computer?

 

Need to be able to provide a local admin password if the unlikely situation occurs that something needs to be done with local admin rights. There will be no IT staff available to deal with the issue locally and remote access may or may not be available.

 

Not really interested in the rights and wrongs or what would or could dictate this need, just need to have the option available should the need arise.

 

Example would be 50 laptops being imaged then sent out to be used remotely at a particular site for 6 months. If i give a local admin password out then all the other machines will have the same password and could be tampered with should the password be handed out.

 

I need a bit of software that will resolve this or some suggestions on generating random passwords for my image that i can quickly reference thus limiting the user to a single machine with admin rights.

 

Any help would be much appreciate guys!!!

[kmount]

Perform an operation on a unique identifier for the device (serial number / mac address) to set a password which will be unique for the laptop, add in a spin for the date it was generated so it's a bit less linear.

 

Something like that might be possible, it's not full proof (unless you have a random seed in the generator) and it depends if you need the password passed 'back' somewhere or if a general calculation which gives the same answer each time is sufficient.

[GrumbleDook]

Add a second local admin account via script (pulling from a text file), each with a different password. Retain the original local admin account as well unless you are worried of someone using a 'tool' to crack accounts on it.

 

This will allow you to use a seed generator as suggested above, but leaves you with a copy of the username and details too.

[plexer]

Use authlite and a yubikey only give them the hardware key when required.

[dalsoth]

Thanks for the replies. I may use a script with a random password thrown in which outputs to a file for use if required. A bit of a pain really. Would much prefer a bit of software that simply lets you use a one time password and then once logged off resets or something. I remember using something like this years ago with security software on machines where we would call someone and they would generate a password using some software which would be single use and would unlock security settings.

 

As the machines are not on the domain, all the domain based methods are no good to me and i searched through many of them via google. I do not want to give out any security dongles or devices to anyone so all the software that uses that approach is no good.

 

Will give a script a go with MDT during the build process and see what happens.

 

Any more suggestions or links to software is much appreciated as i am lazy and would prefer to purchase something more polished and secure.