Comments
Managing The Local Admin Password Headache
Newest First  |  Oldest First  |  Threaded View
RobertL444
50%
50%
RobertL444,
User Rank: Apprentice
4/22/2014 | 11:04:40 PM
re: Managing The Local Admin Password Headache
Hello Will:

 

When you get an opportunity, please take a look at Synergix AD Client Extensions software.  It has a feature to manage Built-In Administrator Account Password.  The password is system generated ( from 8 characters to 48 characters that you set in a GPO ) and is stored in Active Directory.   Only designated administrators are allowed to retrieve the password.  In addition, you can create a backup administrator account.

The password is changed every 7 days ( configurable ) and validated every 24 hours.  This solution is not only useful for the remote laptop users who may have VPN connectivity issues but generally speaking ideal solution for the enterprise.

Take a look at http://www.synergix.com or write to [email protected]

 
Will N
50%
50%
Will N,
User Rank: Apprentice
3/20/2013 | 2:54:37 PM
re: Managing The Local Admin Password Headache
A random unknown password is only more secure to the extent someone doesn't need administrative rights.- The biggest nightmare for us is not having admin credentials when the user is remote.- An executive that can't update their VPN software or otherwise fix something is a nightmare for IT staff.-- The first tenent of security is data availability and my experience is that the most common security failure is this self inflicted denial of availability when someone needs admin and can't get it.

This must be a difficult problem to solve since no one is really
offering anything that works to keep admin credentials both secure, and
available when needed.

USB or CD booting for a password reset with some ugly tool like Kon Boot isn't really a viable solution for tech challenged road warriors. They have to carry along a cd or usb every time they leave the network?- Most people barely keep track of their power supply.
jeffmcjunkin
50%
50%
jeffmcjunkin,
User Rank: Apprentice
3/20/2013 | 4:13:46 AM
re: Managing The Local Admin Password Headache
Jeff McJunkin here, the author of the relevant article.

No, that particular solution doesn't give the ability to look up the random password. Group Policy scripts are inherently viewable by standard users, so any programmatic way of setting the local Administrator passwords would be discoverable in a trivial fashion by any authenticated user.

PXE booting to something like "NT Password Reset" or Kon-Boot does the trick for me (relevant article:-http://jeffmcjunkin.com/2012/0....

If you do end up setting per-desktop passwords, I'd recommend setting it to something like the first 16 characters of SHA1(desktop serial / identifier + known salt). Of course, the salt used in the hashing algorithm would become very important to keep secret.
kmasters787
50%
50%
kmasters787,
User Rank: Apprentice
3/17/2013 | 4:43:32 AM
re: Managing The Local Admin Password Headache
Great timing on this article! -I'll be pursuing a workable solution for my company very soon around unique local admin passwords. -For us, having the ability to find the random local admin password is a must. -(Execs always on the move that get locked out when 1000's of miles away) -Does the "...Randomization via GPO" solution give the ability to-look-up-the random password?


Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-7268
PUBLISHED: 2018-05-21
MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerability in which a local unprivileged user is able to read any root (uid 0) owned file on the system, regardless of the file permissions. Confidential information suc...
CVE-2018-11092
PUBLISHED: 2018-05-21
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.
CVE-2018-11096
PUBLISHED: 2018-05-21
Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account information remotely.
CVE-2018-11320
PUBLISHED: 2018-05-21
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs.
CVE-2018-8142
PUBLISHED: 2018-05-21
A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1035.