Before you consider what I want to achieve as insane from a security standpoint, please continue reading:

I'm setting the password for the local admin account on all computers in the domain with a startup script which contains the password in cleartext, of course.

I have limited file permissions to the script and only Domain Computers and Domain Admins accounts can access the file.

To keep it short, do you still consider what I want to do as insane or is this OK from a security standpoint?

sincerely, fjf2002


My use case is as follows: I just need the local admin accounts in case of a fallback scenario: A computer drops out of the domain or its network adapter goes broken or something like that and then I'd need the local admin account.

In the domain that I'm administering from now on, different computers have different local admin passwords, and the previous administrator (from whom I took over) can't remember the credentials he once set so I thought I had to reset them all.

  • @yagmoth555 I am not sure if I understand correctly. Restricted groups seem to change group memberships, how does that help me? – fjf2002 Oct 21 '18 at 15:04
  • My error, sorry – yagmoth555 Oct 21 '18 at 15:20
  • This is a terrible solution. All someone would need to do is run psexec -s cmd.exe, get a command prompt as system/the computer account, and they can access the script. It's also a security worst practice to have the same password for the administrator account on all computers because it gives attackers lateral movement on a silver platter. – Greg Askew Oct 21 '18 at 16:45
  • @Greg Askew: Thank you, this is the first answer that targets my question. First, as far as I know you can only psexec -s if you have admin rights; but if you have admin rights, you can reset my local admin account password directly. Nothing won. Second, if I choose the local admin account password the same on all machines, this is as far as I understand just as (in-)secure (as you would call it) as a domain admin user - he also has "the same password" on all machines. – fjf2002 Oct 21 '18 at 17:31
  • 1
    @fjf2002 your assumption about how ADDS works relative to using the same password across all machines is wrong. A domain admin password needs to be authenticated against a DC before being allowed to work, which means all you need to do is tell your DC to invalidate that password/account. There is no such protection in your case. The psexec issue isn't about if someone can reset the admin password, it's that they can discover the admin password. As soon as I have your startup script, I have control over every machine you've pushed this out to. Don't do this. – RobbieCrash Oct 22 '18 at 0:31

Your situation is the perfect use-case for LAPS (Local Administrator Password Solution).

It's a free tool from Microsoft to automatically manage the local admin passwords on domain joined Windows machines and keep them stored in AD that you can look up whenever you need them. There are a number of guides out there for setting it up. But if I recall correctly, it mostly consists of getting the agent deployed (doable via GPO software deployment) and configuring a couple group policy settings that tell the agent how often to rotate the password.

  • I know, I have read about LAPS. But I wanted a simple solution and just one password. – fjf2002 Oct 21 '18 at 15:30
  • One common admin password across all machines is largely considered a security bad practice these days. As Greg pointed out in the comments, it basically gives an attacker free reign to move from machine to machine through your network once they can compromise a single machine. – Ryan Bolger Oct 21 '18 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.