3

My team is building out an Active Directory environment in a small grad school with support for general computer labs, and staff/faculty machine and account management.

We have a team of student consultants that are hired to do general help desk work. As of now we have a local admin account on every machine. It has the same password and all of us know it. I know it's not best practice and I want to avoid this with the new setup. We want to have local admin accounts in case there are network issues that prevent AD authentication, but we do not want this account to be generic with a shared password. Is there a way we can get each machine to cache the necessary information to authenticate a group of local admins so that if AD is somehow inaccessible, student consultants can still login with their AD admin accounts?

Improve this question
6
  • yes there is a gpo setting to allow the workstations to cache credentials to get past the lack of network connection to AD. Then create a domain based group put then admin staff in that group then use a gpo setting restricted group and select the previously created group there. Of course they'll need to have logged in once for the cache to work.
    – tony roth
    Mar 16, 2012 at 22:08
  • I was aware of the caching. I was under the impression that it would only cache the last 50 logins. In a lab environment it is quite likely that 50 regular users will login and push out the local admin's credential caches. I was hoping for something very specific where gpupdate can pull the necessary cache info from AD each time it checks in.
    – Michael
    Mar 16, 2012 at 22:35
  • Do you lose connectivity to the domain frequently?
    – tony roth
    Mar 16, 2012 at 23:09
  • No, we're just thinking ahead.
    – Michael
    Mar 16, 2012 at 23:23
  • well I don't think you'll find a way around the 50 unique cached logins so I'd just set the admin account to disabled then hand the student admin a usb stick with MS'S erd pw crack tool. Have them enable the account and change the pw do what they need to do then reboot. Have the gpo disable the admin also on next reboot.
    – tony roth
    Mar 16, 2012 at 23:48

4 Answers 4

Reset to default
1

I've worked in this environment in the past where the machines had up to 20,000 student users, and we never even gave admin rights to our full time employed technicians that installed the systems, and we would never had dreamed of giving students admin rights because of the risk of finding Doom/Quake/Minecraft LAN parties in the labs outside of working hours.

If you are using some deployment technology to reinstall the systems, it only takes a few minutes of technician time to reinstall the PC. It's much more efficient to have someone re-image the system than have somebody logon to diagnose/correct the issue. No admin rights required, as the deployment can handle every part of the deployment processes.

If it is a hardware problem, this will show up within minutes if you are using a network based deployment method, at which point the technician/student simply swaps the PC out with a spare, and diagnoses & fixes the hardware issue before making this machine the new spare.

Network issues as you describe were very rare in my experience, and were usually down to hardware faults rather than software faults, again, no admin rights needed.

Improve this answer
1
  • I'm convinced that we need to step up our use of imaging. A rather indirect solution, but a solution nonetheless.
    – Michael
    Mar 19, 2012 at 22:34
0

enable cached credentials in the domain, and create a password reset disk for the local account. I think however you'll be far too busy with other problems should your entire domain dissapear, what work are users accomplishing without network conectivity? Presuming that their credentials are not cached are you going to let them all log in as admins?

Improve this answer
0

Once Active Directory is in place, it would be used for more than just local admin access, so it would be more fruitful to have higher availability of AD services by having multiple Domain Controllers in the environment. To save resources you can keep one DC as physical and others on virtual environment.

Improve this answer
0

It's good to have a backdoor. There're some things you can do.

1. Emergency Admin

You can create an emergency user om each computer using a GPO. This way the password is still the same on all computers, but it's very easy to change it every month or so.

You can do this in:

Computer Configuration -> Preferences -> Control Panel Settings -> Local Users and groups.

Make sure you have the password set to "never expire" and don't use "User must change password on next logon". You can add the user to the local administrators group also by GPO. You will find it in:

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups

2. Change password script

You can define a startup script for each computer that changes the password to a random value and writes the password to a (secure) location on the network.

You can download a script I wrote in my blog: http://zeda.nl/b05

Improve this answer
13
  • Hi, Zeda. Could you read the section of our FaQ on promotion to make sure this doesn't get flagged as spam.
    – tombull89
    Mar 19, 2012 at 8:48
  • I'm here too help people and I'm pretty sure my answer might help people. Yes, there is a link to my blog, but it's there for that same reason (to help). Besides, it's even on the second solution I provide. Do you really think my answer would be flagged as spam??
    – ZEDA-NL
    Mar 19, 2012 at 8:54
  • No worries - just mention that you run the site linked to - nothing major.
    – tombull89
    Mar 19, 2012 at 8:55
  • thanks. ServerFault tends to take a dim view of self-promotion, regardless of how minor - that's just the way we are.
    – tombull89
    Mar 19, 2012 at 10:31
  • doesn't solve the problem anyway, its still a shared pw.
    – tony roth
    Mar 19, 2012 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .