10

In a Windows environment how do you address the following issues with service accounts?

  1. Regular Password changes - with single service accounts used on multiple machines how do you regularly change passwords without significant outage periods? Do you tend just to never change them?
  2. Keeping track of passwords - by necessity multiple people need to know these, how do you record the passwords whilst keeping them reasonably secret?
  3. To what point do you use the same account across multiple machines / services? How do you track what account is being used where? Any tools to help with this?
  4. Has anyone found any good resources for appropriate minimum permission settings for common service account requirements for applications such as SQL Server, Sharepoint etc.
2
  • I guess point 4 is a little off topic. My main concern is point 1. I can't see how you can change the passwords without having an outage. Jun 23, 2009 at 8:16
  • Even if point 4 is off topic, I'd still love to follow that thread. I found this question while looking for how to prevent interactive logins with a service account. I thought there was a GPO setting, but I haven't found it yet. Sep 18, 2009 at 20:50

4 Answers 4

3

Many of our customers use Secret Server to manage their service accounts.

It can automatically discover where your service accounts are used (will scan your network for usages) and then these Windows Services can be added as a "dependency" for the credential. An expiration schedule can be set (say every 30 days) and then it will automatically generate a new random password for the AD service account and change all the places it used (even stopping and restarting the Windows Services). Secret Server also supports IIS Application Pool users and Windows Scheduled Tasks as "dependencies".

Get a free 30 day trial here: http://www.thycotic.com

4

Switching to Server 2008 R2 all around ^^ (ok, maybe not - but thought I should mention the Managed Service Account and Virtual Account features of it that promises to resolve this mess)

1
  • Thanks for that, I hadn't noticed that in the features list of R2. I'm a big Server 2008 (R1) fan. I was a little disappointed with the stability and performance of 2008 R2 beta compared with Win7 RC - let's hope it's good when they release it Jun 28, 2009 at 21:27
2

Joel,

We use a third party application to manage the rotation of passwords for service accounts. The app tracks the passwords, creates new ones, and offers a vault so that you can access the passwords if and when necessary.

We try to reuse service accounts when possible and as part of the account creation process we have a form that people need to complete. when the form is submitted it is saved and the account that was created gets saved with the form. that way, if we need to know who uses the account, or why it was created, we can research. we also make certain the manager field in AD is filled in correctly and managers are assigned the task of know what service accounts they are responsible for.

MSDN would have a wealth of information regarding the minimum permissions required for common service account settings. As always, how you configure those settings depends upon the needs of your environment.

2
0

i would recommend passgen.exe Download Info Here Just go through its accompanying document. It gives precise scenario of changing password on multiple computers and how easy it is to keep them unique and complex.

Not the answer you're looking for? Browse other questions tagged .