I have seen on numerous occasions that organisations name their admin account anything but admin or administrator. Most often of course people in help desk would use their own account with different levels of admin rights for day to day tasks, but sometimes help desk staff would use a shared admin account that wasn't named admin or administrator, and I was wondering if that's for reasons of safety and security (e.g. harder to guess that the admin account is laracroft).
4
-
2Those who voted this down, could you please add a reason as to why you think this needed a down vote? I would believe this is a valid question, is clear and useful. – Thanks.– Alex IxerasOct 31, 2016 at 5:39
-
Mouse over the down arrow; the popup says "This question does not show any research effort; it is unclear or not useful". Downvotes without comment may be presumed to be for at least one of those reasons.– MadHatterNov 2, 2016 at 8:14
-
Sure, I get that @MadHatter, but I have searched for existing answers and tried to find reasons for naming local or shared admin accounts anything but 'admin' or 'administrator'. In terms of being "unclear" or "not useful" I can't see how my question is either unclear, or not useful. It's a question that arose out of observation and curiosity. All I'm wondering with the down-votes is that someone thinks it's ludicrous to ask a question like this, but then doesn't make an attempt to seek clarification.– Alex IxerasNov 2, 2016 at 22:06
-
2You asked what a downvote-without-comment meant; I told you. You may believe that people shouldn't do them, and you're welcome to hold that belief, but it's not valid around these parts, so other people are unlikely to be bound by it. By the way, a downvote doesn't mean people think your question's ludicrous; merely that it shows no research effort, is unclear, or not useful - we have a whole range of tools, including voting to close and flagging, for those we think ludicrous..– MadHatterNov 3, 2016 at 7:19
Add a comment
|
2 Answers
In Active Directory accountnames must be Unique and AFAIK the account named "Administrator" is one of the defaults that is created and best practice is that "use of the Administrator account should be reserved only for initial build activities, and possibly, disaster-recovery scenarios.".
The means that other admin accounts, the ones people actually use, must be created with a different login name.
-
Thanks. That makes sense. Of course in an environment where help desk staff has ACL-controlled admin rights on various levels it makes sense that they use their account for the tasks they're allowed to handle. Nov 1, 2016 at 0:10
-
I was wondering also if it is good practice to name the admin account on your home network something different than 'admin', but then again, the best practice and defence, among others, is probably having a strong and unique password that goes with it. Nov 1, 2016 at 0:16
It's merely for security and traceability reasons for why we should use a nominative account instead of generique one, because it's hard to guess in case of a brute force attack ,and in case if anything happend we now who did what and when.
PS: It not at all a good pratice to share an administrator account between multiple users ,which will create traceability issue .
-
Thanks, @BENS. Traceability issues would certainly be an argument against shared admin accounts. Then there's also the risk of disgruntled employees… I wonder why so many organisations employ the practice of shared admin accounts though. Nov 1, 2016 at 0:24
-
@AlexIxeras One reason we do it is due to device encryption. Booting a device requires you to decrypt the disk. Doing so requires a valid known account. This step is done before domain awareness, so a single known account that has access to boot laptops is useful. Additionally, when working with laptops, often you need to be able to login as admin to diagnose network faults, and thus a local admin account is useful. That's not to say those shared local admin accounts have domain admin or higher shared permissions...– KHobbitsNov 1, 2016 at 0:41
-
@KHobbits thanks for the info ,could you please if you can ,direct me to any good paper about this issue .– BENSNov 5, 2016 at 19:18