1

In a Windows environment, does the network administrator have access to the user network password? Can he use the user LAN credentials to login to his machine when the user is away?

EDIT - I ask this because my company has implemented SSO to ADP payroll website. If I'm logged in to Windows, I'm automatically logged in to our intranet site. And if I click on ADP link on my intranet site, it automatically (SSO) logs me into ADP portal.

Given this, my network admin can see my personal info, if he has access to my LAN network user/pass. I understand that admin can reset pass etc. but does he have access to real user password on LAN?

1
  • That's not how a good SSO product works; storing the password is not a good idea, so that's almost definitely not how yours works.
    – mfinni
    May 18 '12 at 17:17
3

No. The domain administrator does not have access to any other users password and can't logon to the domain as that user, unless the user has given the domain administrator their password.

3
  • Supplemental, the domain admin could reset the password for the user's account, and login that way.
    – user78214
    May 18 '12 at 17:27
  • Yes, but that's not really what the OP is asking. If the admin changes the OP's password then the OP will be aware of it. My take on the question is "Can the administrator login using my user account without my knowing about it and access my ADP payroll information via SSO to our intranet?".
    – joeqwerty
    May 18 '12 at 17:43
  • I agree that is a well phrased version. I have a feeling that there has got to be a second level of encryption to access the payroll site. I find it hard to believe that when a user logs in to a domain computer using a domain username and password, they are automatically given access to their payroll. There are massive inherent security risk with that. If I were the sysadmin there, I would be scared for my job, because all it takes is one person saying that you logged into their payroll and change something, and BLAM, massive HR investigation....I digress...sorry. Scary.
    – user78214
    May 18 '12 at 19:31
2

A domain admin could enable that passwords are stored with reversible encryption, in which case they could technically access your password. The only places I've seen this done were ones that had old RADIUS products that required AD integration. Any decent SSO product should not require this setting. That said, it's remotely possible, but very unlikely.

1

You can always change any user's password in AD. And I believe if you login to any PC using different credentials it'll kick the other user out. What are you trying to accomplish?

1

They only way the network admin should have the user's login credentials is if the user told the admin what they are. If he is a domain administrator then he can log the user out using his credentials though.

1

In addition to what you have just added within your edit, the network administrator can only have password if he has access to the domain controller and can install his/her own software to brute-force the passwords (very easily if the password is weak). In normal circumstances your answer would be no, he/she does not have your password.

0

My view on this is that the bigger risk is colleagues when a user walks away from their desk and leaves their screen unlocked. Open access to Windows, data, email and any system with SSO.

While typcial Windows passwords are protected in a way they cannot be reversed (given time and resource maybe) it is possible that an extremely bad decision has been made to change this default config. http://technet.microsoft.com/en-us/library/cc784581(v=ws.10).aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.