Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am the Domain Administrator. Is there a way I can log on to a workstation, as a User, without knowing their password?

I know I can reset the user password from Active Directory. But say I did this, how can I put their old password back after I've temporarily reset it to something I know?

EDIT:

It's a nice thought to think we can configure everything through group policy, and that users are even smart enough to complete basic first-time use wizards.. but this is a reality question, not a theoretical one. I agree with you, but when I'm asked to configure outlook on a users desktop, I will honour their request without argument.

And of course, this is ethically obtaining access, whilst the end user is on the phone to me.

share|improve this question

migrated from superuser.com Mar 15 '11 at 20:32

This question came from our site for computer enthusiasts and power users.

4 Answers 4

Imho - The best solution would be to use a client management tool that allows you to remotely overtake a running user session for the time of fixing the tech problem (*).

You would call the user first, and ask him/her to make sure to close all open programs/windows that may underly restrictive access limitations by company laws, plus - if private usage of the company computers is allowed - to close all programs/windows that may be related to that. Furthermore, the management tool will inform your user about your takeover by a message like: "Do you want to allow admin-xyz to gain control over your desktop?", and the user needs to Ok that. Another good thing about that kind of software is, that the user can see what you are doing on its machine. Much more transparent than 'fixing things in the dark'.

I also totally agree to nhinkle's comment - do not ask your users for their passwords! One thing is the mentioned social engineering factor, the other one is that you need to protect yourself from heart attacks by knowing to what kind of amazing passwords your users rely to..

  • iDesktop, TightVNC, TeamViewer, Landesk, etc..
share|improve this answer
    
I like this solution, however, most of them cost money to use. And with a full Microsoft server/client architecture already deployed, it would be nice to use the built in methods. –  servermanfail Feb 11 '12 at 20:38
    
Windows Remote Assistance is built in and free. –  MDMarra Feb 11 '12 at 20:51

As Domain Administrator you shall be able to log on the machine. Usually the screen says: only XXXX or a Administrator can unlock this session.

You never impersonates the user on windows. But you switch user and then manage the session and eventually kill the user session.

By the way, I don't see anycase where you would need to impersonate a user.

As a reference you can look at mssocial.

share|improve this answer
    
Correct, you never impersonate a user directly without their knowledge. One thing you can do is utilize the "Remote Assistance" functioanlity, where the user actively asks you to remote control their machine while they are present. Works a lot better in Vista/Win7 than in XP. –  rmalayter Mar 16 '11 at 0:52
    
"By the way, I don't see anycase where you would need to impersonate a user." - how about configuring outlook for them? –  Kenny Mar 17 '11 at 9:28
    
There are other tools for that: like here I guess. –  M'vy Mar 17 '11 at 9:40
    
The problem with this is that I could lose any unsaved work on the users desktop. Also, the whole exercise is configuring something on behalf of the user on their own profile. –  servermanfail Feb 11 '12 at 20:37

I understand both sides of this political debate. It's "best" to never log in as them but in small shops you often don't have the tools in place to do that. If you don't want to ask the user for their password (I agree you shouldn't ask) then the only option I've seen is to change their PW, then when done set it to expire, tell them the new one, and that when they log back in they will be prompted and can change it back to the old one... unless you've set your AD GPO Password Policy to remember X old passwords. In that case the only option is a new one.

share|improve this answer

Change it and let them know it has been changed (set it to change on first use once you're done so they can change it to something they want).

share|improve this answer
12  
No. NEVER ask a user for their password. This is a crucial policy in IT administration. Users must be taught that nobody, IT staff included, will ever ask for their password. This helps prevent social engineering attacks. –  nhinkle Mar 15 '11 at 18:57
    
Good point, comment removed. –  Windos Mar 15 '11 at 19:07
    
This is the most realistic method proposed so far, but if I'm going to phone the user up and tell them the new password over the phone, which no doubt they'll write down.. I might as well inconvenience them less and just obtain their current password myself over the phone. –  servermanfail Feb 11 '12 at 20:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.