up vote 1 down vote favorite
share [g+] share [fb]

We have a network with Windows 7 Enterprise machines, all members of a domain. We've been keeping a local (unlocked) 'Admin' account on each workstation in parallel to the built-in (locked) 'Administrator' account. Since installation of the OS requires an initial account to be created before the computer is joined into the domain, we've left the 'Admin' account with a strong password as it is. However, this requires the same password to be used across machines, and possibly never expiring.

Note that in our environment we don't restrict users (mostly developers) much and don't plan to do so. Usually domain user accounts are members of the Administrators group on respective desktops. On the other hand, we try to keep things centrally managed.

What are the pros and cons of keeping such local (non-domain) admin accounts on domain-joined workstations in respect to:

  • security
  • management
  • data access
  • problem solving
link|improve this question
60% accept rate
feedback

1 Answer

up vote 1 down vote

my rep is still too low to post comments so i have to post this as an answer:

having a local admin account is generally a good idea, when the network fails or the domain membership expires you can still log in and fix the problem. BUT having the same password for all machines is no good idea, there are two possible solutions for this 1. change the password regulary 2. write some script that generates a random password and store it where only you have access (e.g. on a share)

link|improve this answer
A better way to store these passwords would be to use a unique identifier to the system (like either a hostname, or serial number etc..) and create a "generator" that you can query with this identifier and it will produce the password. This way, you don't have actual admin passwords written somewhere, and you can access/password protect this generator. – sandroid Oct 30 '11 at 21:00
then your passwords are only as good as the generating algorith, also you would have to hide/protect the generator itself. – weberik Oct 30 '11 at 22:23
Having a unique password for each machine is generally a good idea; however, it's a security/complexity tradeoff. I'm speaking about ~10 machines. Also, I'd recommend using a password manager like KeePass. My primary concern rather is whether I'd ever need a local admin account once the machine is in a domain -- whether this is a frequently used measure or not. – Ondrej Tucny Oct 30 '11 at 22:47
maybe you can disable the local admin account completely then, if there is a problem you still could activate it using some bootable recovery tool like ntpasswd or CIA/ERD commander. i used local admin accounts quite a few times in my life, usually when the domain is not reachable due to network problems – weberik Oct 30 '11 at 23:00
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.