9

I am the Domain Administrator. Is there a way I can log on to a workstation, as a User, without knowing their password?

I know I can reset the user password from Active Directory. But say I did this, how can I put their old password back after I've temporarily reset it to something I know?

EDIT:

It's a nice thought to think we can configure everything through group policy, and that users are even smart enough to complete basic first-time use wizards.. but this is a reality question, not a theoretical one. I agree with you, but when I'm asked to configure outlook on a users desktop, I will honour their request without argument.

And of course, this is ethically obtaining access, whilst the end user is on the phone to me.

4 Answers 4

4

Imho - The best solution would be to use a client management tool that allows you to remotely overtake a running user session for the time of fixing the tech problem (*).

You would call the user first, and ask him/her to make sure to close all open programs/windows that may underly restrictive access limitations by company laws, plus - if private usage of the company computers is allowed - to close all programs/windows that may be related to that. Furthermore, the management tool will inform your user about your takeover by a message like: "Do you want to allow admin-xyz to gain control over your desktop?", and the user needs to Ok that. Another good thing about that kind of software is, that the user can see what you are doing on its machine. Much more transparent than 'fixing things in the dark'.

I also totally agree to nhinkle's comment - do not ask your users for their passwords! One thing is the mentioned social engineering factor, the other one is that you need to protect yourself from heart attacks by knowing to what kind of amazing passwords your users rely to..

  • iDesktop, TightVNC, TeamViewer, Landesk, etc..
2
  • I like this solution, however, most of them cost money to use. And with a full Microsoft server/client architecture already deployed, it would be nice to use the built in methods. Feb 11, 2012 at 20:38
  • 1
    Windows Remote Assistance is built in and free.
    – MDMarra
    Feb 11, 2012 at 20:51
2

As Domain Administrator you shall be able to log on the machine. Usually the screen says: only XXXX or a Administrator can unlock this session.

You never impersonates the user on windows. But you switch user and then manage the session and eventually kill the user session.

By the way, I don't see anycase where you would need to impersonate a user.

As a reference you can look at mssocial.

4
  • Correct, you never impersonate a user directly without their knowledge. One thing you can do is utilize the "Remote Assistance" functioanlity, where the user actively asks you to remote control their machine while they are present. Works a lot better in Vista/Win7 than in XP.
    – rmalayter
    Mar 16, 2011 at 0:52
  • "By the way, I don't see anycase where you would need to impersonate a user." - how about configuring outlook for them?
    – Kenny
    Mar 17, 2011 at 9:28
  • There are other tools for that: like here I guess.
    – M'vy
    Mar 17, 2011 at 9:40
  • The problem with this is that I could lose any unsaved work on the users desktop. Also, the whole exercise is configuring something on behalf of the user on their own profile. Feb 11, 2012 at 20:37
1

I understand both sides of this political debate. It's "best" to never log in as them but in small shops you often don't have the tools in place to do that. If you don't want to ask the user for their password (I agree you shouldn't ask) then the only option I've seen is to change their PW, then when done set it to expire, tell them the new one, and that when they log back in they will be prompted and can change it back to the old one... unless you've set your AD GPO Password Policy to remember X old passwords. In that case the only option is a new one.

0

Change it and let them know it has been changed (set it to change on first use once you're done so they can change it to something they want).

4
  • 18
    No. NEVER ask a user for their password. This is a crucial policy in IT administration. Users must be taught that nobody, IT staff included, will ever ask for their password. This helps prevent social engineering attacks.
    – nhinkle
    Mar 15, 2011 at 18:57
  • Good point, comment removed.
    – Windos
    Mar 15, 2011 at 19:07
  • This is the most realistic method proposed so far, but if I'm going to phone the user up and tell them the new password over the phone, which no doubt they'll write down.. I might as well inconvenience them less and just obtain their current password myself over the phone. Feb 11, 2012 at 20:39
  • It's still horrible practice to ask for their password. Someone could impersonate you over the phone and ask your clients for their passwords. It's not likely, but I'm sure has happened at some point to someone. Plus it convinces them that IT needs their password at some point. I'd rather find a way to have them log in themselves (through Remote Desktop) or change their password. They then have to change it back or to something else, but c'est la vie and you're protected. Aug 9, 2018 at 4:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .