I am trying to beef up my domain security, and part of this process (as after somr RTFM) is:
- Service Administrator Accounts - for services (Anti Virus, spiceworks, Task Scheduler, NAS backup, SQL admin, etc..)
- Personal Administrator Accounts for admins (CIO, CTO, RD Mgr...)
- try to limit use of the domain admin to NULL
however, I am having trouble organizing in my head the way the these accounts should be:
for the service ADM accounts - it's pretty clear (have access to only what they need to do, and remove gui access )
but for the personal administrators: what are the credentials they (I and others) need to be?
Since I will create literally the same work, only login as the adm.myuser.name with a password, should I add my self to the Administrators group?
- Doing that does help a bit in controlling the users, limiting shared accounts etc, but is that how it should be done?
what is the best practice to have such Personal Domain Administrators?
Once I start in this road, there gonna be so many more users that I need to control and monitor - how do I do that? - How do I monitor my srv.adm.sql user ?