Re: Builtin administrator password strategy ?

Presently I am setting the password the same over the servers.
I have script that does this, previously used modules (evolved
over time) to make these per-machine unique, based on passphrase
generation in pseudorandom fashion with custom complexity reqs.
The password length is long beyond human tolerance. We do not
use the local admin accounts unless the machine is not network alive,
so the strength of the password is only a slowdown in the rare event
the account is used. Even with the rainbow methods you mention,
hitting against multiple machines trying for one password, I am not
too concerned because of the following: I get reports that show
high pwd-failure login attempt origin points consolidated from
server set of choice, I generally have the local admin account set
so that it is not useful over the network but only for console login,
the pwd used is quite long, complex, randomish.


"Pascal" <pascal_t@xxxxxxxxxxxxxxxxxx> wrote in message news:mn.c2e67d7480512a8a.70874@xxxxxxxxxxxxxxxxxxxxx
I did this once in a very big environment. We actually used a password setting utility (PASSGEN) that created pseudo random passwords based on two pieces of seed material, so the password was actually randomly generated at boot time. We used a fixed pass phrase and the computer name as the other seed. The goal wasn't to keep the password secret from administrators, but to enable you to give out the local admin password for one server without compromising the whole environment. Being a systems integrator I just put this in place and don't manage it, so I imagine that after stuffing around with it for a few months they probably reset them all to Passw0rd.
"Pascal" <pascal_t@xxxxxxxxxxxxxxxxxx> wrote in message news:mn.bc1f7d74f2b9dd7f.70874@xxxxxxxxxxxxxxxxxxxxx
Hi,

I would like to know what are your advices about configuring different builtin\administrator password for each server on your domain.

It is quite unsecure to configure every servers with the same admin password, so I would like to know how do you manage this ?

Do you have an excel file with every passwords listed ? (lol)
Do you have a method to give a password depending on the role of the server ? like Admin1saF1rew@ll, AdminExch@nge etc...
Do you have some advices ! :D

Thank you

-- Pascal



Thank you everybody for your answers and different point of view !

I totally agree that it is really hard to manage admin password if they are different from every servers.
I am just interested about the risk of configuring the same admin password on every servers. An attacker could potentially crack this password and gain access on every computers on the domain (and the DC's too so)

We can find some websites that propose distributed cracking method that can crack a 15 passwords lenght in few minutes or hours so ... :D

P.S: Sorry for my "bad" english ;-)

-- Pascal



Thank you for your feedback Roger.

I am not using the local admin password too, and I audit it regularly.
How do you get reports that show high password failure login attempt ?

The possible of sending me an alert that after 20 consecutive failed password attempt interests me :D

Thank you

--
Pascal


.

Relevant Pages

  • Re: Builtin administrator password strategy ?
    ... generation in pseudorandom fashion with custom complexity reqs. ... use the local admin accounts unless the machine is not network alive, ... password for one server without compromising the whole environment. ...
    (microsoft.public.windows.server.active_directory)
  • Re: how do I logon to local admin on server 2003 doman
    ... Yes this is a domain controller and I have a 2000 server that is a domain ... chkdsk but when you type in chkdsk it ask you for the local admin password. ... I tried the domain admin password but it would not work. ... First question is why do you assume that you need to be local administrator ...
    (microsoft.public.security)
  • Re: How to get back my administrator password?
    ... > Hi Roland, ... > previous admin password because it is useful on the server. ... > get back my local admin privilege. ...
    (microsoft.public.security)
  • Re: SBS administrator password clearly compromised by inside attack, h
    ... now on a standalone machine it's no biggie... ... When I attempted to remote connect to the server, ... The server was configured "out of the box" with mobile users for all accounts and only the single admin password. ... a 64b wep key was generated from that password. ...
    (microsoft.public.windows.server.sbs)
  • Re: URGENT - Invoke destructive batch files on login
    ... If you know the admin password and have a workstation with the AD tools ... I'd then create an alternate administrator account and start investigating ... an ex contractor has changed the login password for our SBS2003 ... server, not only that but he has added a batch file to invoke if we ...
    (microsoft.public.windows.server.sbs)
Loading