Perimeter
3/15/2013
02:45 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Managing The Local Admin Password Headache

Forcing and managing unique passwords on Windows systems in an enterprise network can be challenging, but many tools are out there to help

In my past couple of blog entries, I wrote about some protection mechanisms for keeping the local administrator account safe on Windows systems. There are many reasons for wanting to keep the admin account safe. Some IT shops may say their primary reason is prevention against an attacker spreading further throughout the network, while others are more concerned about users elevating their privileges and modifying their systems, which introduces so many additional problems.

From a security perspective, I lean toward the former explanation, but the latter is also valid. I've seen all too often during penetration tests that we've performed that as soon as we get a local administrator on one system, all other systems fall, and we're minutes from domain admin. From there, we can pillage all we want in order to find the necessary information to take control of the network infrastructure, Unix environment, virtualization environment, etc.

While having unique passwords for the local administrator accounts on the Windows (and Unix) systems won't stop an experienced attacker, it will slow them down. That slowdown will hopefully be enough to cause the attacker to make a mistake, trigger antivirus, or generate a log event that allows you to detect him.

The following is a sampling of products that can assist in creating unique passwords for the local administrator accounts in a Microsoft Windows environment. Some of the commercial offerings are cross-platform and can also handle Unix-based systems, network devices, and more. For now, I'm more focused on the Windows side of things.

This is a list of some of the many commercial solutions I've come across as I've researched the topic for clients. Many "privileged identity management" solutions are available on the market that can manage local admin accounts.

This is a list of free and/or open-source applications and scripts that do everything from remotely change passwords on a list of systems to create random passwords via group policies. My "roots" are in a large university environment, so I like free and open-source tools, but you get what you pay for, so be careful with some of these.

Initially, I wasn't a fan of randomizing local passwords to something you don't know, but the more I thought about it over time, I realized that it doesn't matter. Obviously, if the system is part of a domain, then you should be able to do anything you need to remotely connect over the network. If, for some reason, there is a problem and the system cannot connect to the network, then there are plenty of tools out there that will let you boot the system and modify or bypass the local admin password so that you can get in.

If you have any practical experience with any of the tools above, please leave a comment or send me an e-mail. I've had clients implement several of the commercial solutions, but none of the free options. I'd be interested to hear how they've worked out.

John Sawyer is a Senior Security Analyst with InGuardians, Inc. The views and opinions expressed in this blog are his own and do not represent those of his employer. He can be reached at johnhsawyer@gmail.com and found on Twitter @johnhsawyer.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RobertL444
50%
50%
RobertL444,
User Rank: Apprentice
4/22/2014 | 11:04:40 PM
re: Managing The Local Admin Password Headache
Hello Will:

 

When you get an opportunity, please take a look at Synergix AD Client Extensions software.  It has a feature to manage Built-In Administrator Account Password.  The password is system generated ( from 8 characters to 48 characters that you set in a GPO ) and is stored in Active Directory.   Only designated administrators are allowed to retrieve the password.  In addition, you can create a backup administrator account.

The password is changed every 7 days ( configurable ) and validated every 24 hours.  This solution is not only useful for the remote laptop users who may have VPN connectivity issues but generally speaking ideal solution for the enterprise.

Take a look at http://www.synergix.com or write to robert@synergix.com

 
Will N
50%
50%
Will N,
User Rank: Apprentice
3/20/2013 | 2:54:37 PM
re: Managing The Local Admin Password Headache
A random unknown password is only more secure to the extent someone doesn't need administrative rights.-á The biggest nightmare for us is not having admin credentials when the user is remote.-á An executive that can't update their VPN software or otherwise fix something is a nightmare for IT staff.-á-á The first tenent of security is data availability and my experience is that the most common security failure is this self inflicted denial of availability when someone needs admin and can't get it.

This must be a difficult problem to solve since no one is really
offering anything that works to keep admin credentials both secure, and
available when needed.

USB or CD booting for a password reset with some ugly tool like Kon Boot isn't really a viable solution for tech challenged road warriors. They have to carry along a cd or usb every time they leave the network?-á Most people barely keep track of their power supply.
jeffmcjunkin
50%
50%
jeffmcjunkin,
User Rank: Apprentice
3/20/2013 | 4:13:46 AM
re: Managing The Local Admin Password Headache
Jeff McJunkin here, the author of the relevant article.

No, that particular solution doesn't give the ability to look up the random password. Group Policy scripts are inherently viewable by standard users, so any programmatic way of setting the local Administrator passwords would be discoverable in a trivial fashion by any authenticated user.

PXE booting to something like "NT Password Reset" or Kon-Boot does the trick for me (relevant article:-áhttp://jeffmcjunkin.com/2012/0....

If you do end up setting per-desktop passwords, I'd recommend setting it to something like the first 16 characters of SHA1(desktop serial / identifier + known salt). Of course, the salt used in the hashing algorithm would become very important to keep secret.
kmasters787
50%
50%
kmasters787,
User Rank: Apprentice
3/17/2013 | 4:43:32 AM
re: Managing The Local Admin Password Headache
Great timing on this article! -áI'll be pursuing a workable solution for my company very soon around unique local admin passwords. -áFor us, having the ability to find the random local admin password is a must. -á(Execs always on the move that get locked out when 1000's of miles away) -áDoes the "...Randomization via GPO" solution give the ability to-álook-up-áthe random password?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.