Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to create domain accounts that can only be accessed via a domain administrator or similar access?

The goal is to create domain users that have certain network access based on their task but these users are only meant for automated jobs. As such, they don't need passwords and a domain admin can always do a run-as to drop down to the correct user to run the job. No password means no chance of someone guessing it or it being written down or lost.

This may belong on SuperUser ServerFault but I am going to try here first since it's on the fuzzy border to me. I am also open to constructive alternatives.

share|improve this question

migrated from Nov 25 '11 at 17:28

This question came from our site for professional and enthusiast programmers.

up vote 3 down vote accepted

There is no equivalent to a passwordless root user that can only be used via sudo in AD-land. If a user has no password, it will be passwordless for anyone on anything.

For AD, the accepted practice for service-accounts is to give it a hard-to-type password of some kind that is nigh unbreakable (long AND complex) and embed it into the Service-login needed. Such passwords may be exempted from password-rotation schemes; a 70 character password of random ASCII just might be complex enough to bypass rotation requirements, but not all entities are of the same opinion.

For accounts that are to be accessed via Run-As, those accounts are typically subject to the same password complexity and rotation requirements as regular login accounts.

share|improve this answer
+1 We use Secure Password Generator (also first Google result for "rnd pass gen") to create our service account passwords. They're exempt from rotation policies, but have to be at least 24 characters long (our system also effectively limits brute forcing to 1 try per minute; no worries there). Service Accounts should be explicitly denied interactive logon for the domain too. – Chris S Nov 25 '11 at 21:10
you can make a root type user, it's just painful and introduces support issues. I wouldn't advocate static passwords- all passwords should be changed periodically regardless of length. A compromised password is a compromised password regardless of how long you make it. – Jim B Nov 25 '11 at 22:30

You need to use a fine grained password policy and then change the acl on the account to allow only certain computer accounts or users to access the account.

Don't do this.

This would make really really significant changes to AD that may not be supported by microsoft. What you really want is a password no-one knows because it's autogenerated and autochanges periodically. These are called managed service accounts, and can be used to run services that need privleged access on a per computer basis.

share|improve this answer
Note: Managed Service Accounts only work with Server 2008 R2. – Chris S Nov 25 '11 at 21:38
So do fine grained password policies. If you are still in a 2003 AD in 2011 you have far larger issues than how to make "root" type accounts in AD – Jim B Nov 25 '11 at 22:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.