Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

3/15/2013
02:45 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Managing The Local Admin Password Headache

Forcing and managing unique passwords on Windows systems in an enterprise network can be challenging, but many tools are out there to help

In my past couple of blog entries, I wrote about some protection mechanisms for keeping the local administrator account safe on Windows systems. There are many reasons for wanting to keep the admin account safe. Some IT shops may say their primary reason is prevention against an attacker spreading further throughout the network, while others are more concerned about users elevating their privileges and modifying their systems, which introduces so many additional problems.

From a security perspective, I lean toward the former explanation, but the latter is also valid. I've seen all too often during penetration tests that we've performed that as soon as we get a local administrator on one system, all other systems fall, and we're minutes from domain admin. From there, we can pillage all we want in order to find the necessary information to take control of the network infrastructure, Unix environment, virtualization environment, etc.

While having unique passwords for the local administrator accounts on the Windows (and Unix) systems won't stop an experienced attacker, it will slow them down. That slowdown will hopefully be enough to cause the attacker to make a mistake, trigger antivirus, or generate a log event that allows you to detect him.

The following is a sampling of products that can assist in creating unique passwords for the local administrator accounts in a Microsoft Windows environment. Some of the commercial offerings are cross-platform and can also handle Unix-based systems, network devices, and more. For now, I'm more focused on the Windows side of things.

This is a list of some of the many commercial solutions I've come across as I've researched the topic for clients. Many "privileged identity management" solutions are available on the market that can manage local admin accounts.

This is a list of free and/or open-source applications and scripts that do everything from remotely change passwords on a list of systems to create random passwords via group policies. My "roots" are in a large university environment, so I like free and open-source tools, but you get what you pay for, so be careful with some of these.

Initially, I wasn't a fan of randomizing local passwords to something you don't know, but the more I thought about it over time, I realized that it doesn't matter. Obviously, if the system is part of a domain, then you should be able to do anything you need to remotely connect over the network. If, for some reason, there is a problem and the system cannot connect to the network, then there are plenty of tools out there that will let you boot the system and modify or bypass the local admin password so that you can get in.

If you have any practical experience with any of the tools above, please leave a comment or send me an e-mail. I've had clients implement several of the commercial solutions, but none of the free options. I'd be interested to hear how they've worked out.

John Sawyer is a Senior Security Analyst with InGuardians, Inc. The views and opinions expressed in this blog are his own and do not represent those of his employer. He can be reached at [email protected] and found on Twitter @johnhsawyer.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RobertL444
50%
50%
RobertL444,
User Rank: Apprentice
4/22/2014 | 11:04:40 PM
re: Managing The Local Admin Password Headache
Hello Will:

 

When you get an opportunity, please take a look at Synergix AD Client Extensions software.  It has a feature to manage Built-In Administrator Account Password.  The password is system generated ( from 8 characters to 48 characters that you set in a GPO ) and is stored in Active Directory.   Only designated administrators are allowed to retrieve the password.  In addition, you can create a backup administrator account.

The password is changed every 7 days ( configurable ) and validated every 24 hours.  This solution is not only useful for the remote laptop users who may have VPN connectivity issues but generally speaking ideal solution for the enterprise.

Take a look at http://www.synergix.com or write to [email protected]

 
Will N
50%
50%
Will N,
User Rank: Apprentice
3/20/2013 | 2:54:37 PM
re: Managing The Local Admin Password Headache
A random unknown password is only more secure to the extent someone doesn't need administrative rights.- The biggest nightmare for us is not having admin credentials when the user is remote.- An executive that can't update their VPN software or otherwise fix something is a nightmare for IT staff.-- The first tenent of security is data availability and my experience is that the most common security failure is this self inflicted denial of availability when someone needs admin and can't get it.

This must be a difficult problem to solve since no one is really
offering anything that works to keep admin credentials both secure, and
available when needed.

USB or CD booting for a password reset with some ugly tool like Kon Boot isn't really a viable solution for tech challenged road warriors. They have to carry along a cd or usb every time they leave the network?- Most people barely keep track of their power supply.
jeffmcjunkin
50%
50%
jeffmcjunkin,
User Rank: Apprentice
3/20/2013 | 4:13:46 AM
re: Managing The Local Admin Password Headache
Jeff McJunkin here, the author of the relevant article.

No, that particular solution doesn't give the ability to look up the random password. Group Policy scripts are inherently viewable by standard users, so any programmatic way of setting the local Administrator passwords would be discoverable in a trivial fashion by any authenticated user.

PXE booting to something like "NT Password Reset" or Kon-Boot does the trick for me (relevant article:-http://jeffmcjunkin.com/2012/0....

If you do end up setting per-desktop passwords, I'd recommend setting it to something like the first 16 characters of SHA1(desktop serial / identifier + known salt). Of course, the salt used in the hashing algorithm would become very important to keep secret.
kmasters787
50%
50%
kmasters787,
User Rank: Apprentice
3/17/2013 | 4:43:32 AM
re: Managing The Local Admin Password Headache
Great timing on this article! -I'll be pursuing a workable solution for my company very soon around unique local admin passwords. -For us, having the ability to find the random local admin password is a must. -(Execs always on the move that get locked out when 1000's of miles away) -Does the "...Randomization via GPO" solution give the ability to-look-up-the random password?
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.
CVE-2019-6650
PUBLISHED: 2019-09-20
F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings.
CVE-2014-10396
PUBLISHED: 2019-09-20
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.