Re: Block remote access for the default domain administrator
- From: Joe <joe@xxxxxxxxxxxxxx>
- Date: Fri, 13 Jan 2006 19:30:36 +0000
ST wrote:
I have been requested to set up an alternate administrator account for remote administration and then block remote access for the default domain administrator account named "Administrator".
The strong password set on the Administrator account should be sufficient but he feels remote administration would be more secure using an account with a different name and strong password as well.
I created a new account, gave it a strong password and added it to the domain administrators group. I left the default Administrator account alone except that I removed it from the Remote Web Workplace users group.
Everything is working except that the default Administrator account still has remote access via RWW.
Is it possible to do this?
I don't think so. Microsoft believes that the Administrator must never be locked out. I disagree, but oddly, Microsoft's view prevails. Neither the loss of remote admin facilities nor having the server cracked is particularly desirable, but I know which I'd prefer.
The best you can do is to make the built-in Administrator's password unbelievably strong and lock it in the company safe. Use the additional admin account. There are a few times when you will need to use the built-in Admin, such as applying SP1, but not many.
I prefer not to use Terminal Server for admin directly, but via VPN. That way I can connect using an unprivileged account then use TSWeb with my admin account, which does not have connection privileges. This means a break-in does not give immediate admin privileges. Either an elevation-of-privilege exploit must be known or a second password cracked while already connected. Either way, more tracks are left, more time is taken, and it is unlikely that an automated attack process would succeed. It does, of course, depend on the built-in Administrator password holding up. .
- References:
- Prev by Date: Re: Companyweb works from only 1 external site
- Next by Date: Re: http://servername/extensions
- Previous by thread: Block remote access for the default domain administrator
- Next by thread: No icon in my desktop, no user interface
- Index(es):
Relevant Pages
|
