Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In a Windows environment, does the network administrator have access to the user network password? Can he use the user LAN credentials to login to his machine when the user is away?

EDIT - I ask this because my company has implemented SSO to ADP payroll website. If I'm logged in to Windows, I'm automatically logged in to our intranet site. And if I click on ADP link on my intranet site, it automatically (SSO) logs me into ADP portal.

Given this, my network admin can see my personal info, if he has access to my LAN network user/pass. I understand that admin can reset pass etc. but does he have access to real user password on LAN?

share|improve this question
    
That's not how a good SSO product works; storing the password is not a good idea, so that's almost definitely not how yours works. –  mfinni May 18 '12 at 17:17

6 Answers 6

up vote 3 down vote accepted

No. The domain administrator does not have access to any other users password and can't logon to the domain as that user, unless the user has given the domain administrator their password.

share|improve this answer
    
Supplemental, the domain admin could reset the password for the user's account, and login that way. –  francisswest May 18 '12 at 17:27
    
Yes, but that's not really what the OP is asking. If the admin changes the OP's password then the OP will be aware of it. My take on the question is "Can the administrator login using my user account without my knowing about it and access my ADP payroll information via SSO to our intranet?". –  joeqwerty May 18 '12 at 17:43
    
I agree that is a well phrased version. I have a feeling that there has got to be a second level of encryption to access the payroll site. I find it hard to believe that when a user logs in to a domain computer using a domain username and password, they are automatically given access to their payroll. There are massive inherent security risk with that. If I were the sysadmin there, I would be scared for my job, because all it takes is one person saying that you logged into their payroll and change something, and BLAM, massive HR investigation....I digress...sorry. Scary. –  francisswest May 18 '12 at 19:31

A domain admin could enable that passwords are stored with reversible encryption, in which case they could technically access your password. The only places I've seen this done were ones that had old RADIUS products that required AD integration. Any decent SSO product should not require this setting. That said, it's remotely possible, but very unlikely.

share|improve this answer

You can always change any user's password in AD. And I believe if you login to any PC using different credentials it'll kick the other user out. What are you trying to accomplish?

share|improve this answer

They only way the network admin should have the user's login credentials is if the user told the admin what they are. If he is a domain administrator then he can log the user out using his credentials though.

share|improve this answer

In addition to what you have just added within your edit, the network administrator can only have password if he has access to the domain controller and can install his/her own software to brute-force the passwords (very easily if the password is weak). In normal circumstances your answer would be no, he/she does not have your password.

share|improve this answer

My view on this is that the bigger risk is colleagues when a user walks away from their desk and leaves their screen unlocked. Open access to Windows, data, email and any system with SSO.

While typcial Windows passwords are protected in a way they cannot be reversed (given time and resource maybe) it is possible that an extremely bad decision has been made to change this default config. http://technet.microsoft.com/en-us/library/cc784581(v=ws.10).aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.