Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I recently changed the network at my job so users log in to the domain and have their settings and files hosted on the server, where previously they logged in to local accounts on each computer and had permissions to access server files stores. The only real downside is that, if I log into a user's machine remotely (I use logmein, which lets you control a computer as if you were sitting in front of it - we're a small business, we don't have the need or budget for anything more elaborate), I have to log in as an account I know the password for. I'd like to be able to log in to user's accounts for troubleshooting, so I can have the exact same environment as the user.

However, I don't want to just have a list of everyone's passwords. It's feasible (there are less than 10 of us), but besides the security issue and the problem of maintaining it, I've spent the last 2 years drilling basic password security into my user's heads and it's actually starting to get through. Asking for their passwords would undo that.

So, is there a way to log in to a user's account without their password? Can a second password be set up, or some other way to log in that doesn't disrupt the user's normal login? Is there a better way of getting the exact same environment a user has that I'm missing?

I'm a domain admin and have full access to everything on the network.

share|improve this question

3 Answers 3

up vote 4 down vote accepted
  1. No, there isn't a way to log in as the user without knowing their password.

  2. No, there's no way of having a second password for the user.

  3. Why would asking the user for their password "undo" their understanding of creating and maintaining strong passwords and the understanding of how and why to protect their passwords? Would they not understand the purpose of your asking for their password? Would they then just say to themselves " Since Jim asked me for my password so he could troubleshoot my problem, I guess I can just forget and ignore everything he's taught me about password security."?

  4. How about requiring that the user change their password at the next logon after you've asked them for their password and resolved their problem. That way you've got their current password for troubleshooting the problem and when you're done you set the option to require a password change at next logon (which is pretty standard practice).

share|improve this answer
    
4 is the current way I'm doing things, which works okay. Too bad there isn't another way - I try to eliminate inconveniences for my users, even minors ones. –  ChimneyImp Jul 27 '12 at 18:00
    
If a regular, non insane password policy is in place, and your users still find it inconvenient, its time for some user reeducation. And personally, I find it offensive if my users expect ME to remember THEIR passwords. (not to mention liability, etc) –  DanBig Jul 27 '12 at 18:16
    
Additionally, in the US you may wish to talk to an attorney, as a worst case scenario is that joe user commits a cyber crime then uses you as the person that stole his credentials. –  Jim B Jul 29 '12 at 22:25
    
@DanBig, my users tend towards older and somewhat technophobic, they find a lot of things inconvenient. I see it as core to my job to shield them from most of that so they can do... whatever they do. –  ChimneyImp Jul 31 '12 at 16:53

You could try using a program called Team Viewer. There is a free version of this, but for business purposes you'll have to purchase the commercial license. It's pretty cheap. It has some issues with some VPN's, but you could work that out with the free version.

www.teamviewer.com

share|improve this answer

Reset their password and log on with the new one you made. Then restore their old password or leave a post-it note to call you to get a new password.

EDIT: As requested, one way you can restore a password in active directory is with the authrotative restore. Read more about it here.

share|improve this answer
1  
I'd love to hear how you restore their password in AD! –  Cheekaleak Jul 27 '12 at 18:15
    
This answer is a bit of a catch 22. –  joeqwerty Jul 27 '12 at 18:17
    
@Cheekaleak It's pretty easy to restore the passwords! If you take my class I can teach you how. –  ponsfonze Jul 27 '12 at 18:30
    
Please wise one, teach us the ways of restoring individual AD passwords. –  DanBig Aug 1 '12 at 12:23
    
@DanBig The answer is updated for your question. –  ponsfonze Mar 19 at 13:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.