Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've just taken over the administration of a Windows 2008 web server from a previous employee on a temporary basis. I need to change the Admin password as soon as I can but I've noticed that quite a few of the services also run under this account. So:

  1. Is there a quick way to find out which services will be affected by me changing the password or is it a question of going down the list?
  2. It doesn't seem right to me that the Admin account is used in this manner; should I create a different account for these services, or is using the Admin a/c standard practice?
  3. I realize everyone's servers / networks are set up differently, but are there any other items I should be aware of when changing the Admin password?

Thanks

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

1) You'll have to scroll the list, but you can sort it by the "Log On As" column, so you can quickly find which ones are using other accounts than LocalSystem, LocalService and NetworkService.

2) This is definitely not a best practice, so, yes, you should change those user accounts; but before doing that, you should check what access rights do those services actually need in order to work. If you're going to use a custom user account (i.e. not one of LocalSystem, LocalService or NetworkService), you'll have to at least grant it the "Log On As A Service" right.

3) You should check Scheduled Tasks on that server, and also check if some other application is connecting to that server over the network using the Administrator account. Being it a web server, I'd also check the application pool identities in IIS, although it would be very unwise to have them run as Administrator; but the same is true for services, so...

share|improve this answer
    
Great, thanks for info. –  Nick Jun 3 '10 at 13:40
add comment

I may be wrong here but I would have thought that the services would start up irrespective of the password for the Admin account as long as that user had logged in. Having said that if they require access through a proxy server then you may well find they start throwing up connection errors or login dialogue boxes. I would have thought it best to limit the amount of processes and services running at the level of an admin purely to limit the damage that could occur if someone nasty was able to take control of it. For example we have several systems that require access through the proxy server here and have a low level user account setup purely for the purpose. This account is auditted quite closely so that any deviations from normal behaviour can be quickly picked up.

Having said all this though it would be nice to know if the Admin account you refer to is a domain admin account or a local admin account for your servers and how it all fits together.

share|improve this answer
1  
If the account is directly specified, and not set to Network Service, then yes, a password change will need to be set in the service as well. –  DanBig Jun 3 '10 at 13:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.