2

I have an employee that is taking some forced time off, but I need to mitigate risks in case they go AWOL.

If I change a domain admin password on a live running system can anything go wrong? I don't always follow best practices and I have a few servers that login using domain admin accounts.

I can log off and log back in to those servers, but are there any nuances that I'm not aware of?

Are there any other gotchas that I need to be aware?

joeqwerty
  • 109,901
  • 6
  • 81
  • 172
WearyBoss
  • 21
  • 1

2 Answers2

7

Yes, be wary of scheduled tasks, applications, and services that may be configured to use the Administrator account.

joeqwerty
  • 109,901
  • 6
  • 81
  • 172
  • 1
    Yep, you better schedule this when there's low amounts of user activity and you can focus on chasing fall-out. And do document along the way :-) This might affect backups, SQL service launch at startup, blackberry services communicating with exchange,... the sky is the limit :-/ – DutchUncle Jun 13 '11 at 17:05
2

If you have applications like sharepoint or sql server they may use the admin password internally.

If you are just talking about a file server or exchange server then its usually pretty simple, change it, reboot all the servers and see what hasn't restarted. In most cases it will just restart and work. Obviously, do this out of hours.

If you are running any third party backup software then it almost certainly uses the admin password.

Simply changing the admin password isn't enough though if you are paranoid about things. You will need to see which accounts have admin rights and check those. They may well have created other accounts - its not that unusual to have a backup account or a special account for running batch jobs, which will have privs. They may even have created backdoor type accounts with innocous names like 'sys' or 'printserver'.

How much do you trust this person not to have made sure they have a way back in if you do change the admin password? If you think they've been up to no good and theres money involved then pay someone to look the system over.

Ian

Ian Murphy
  • 1,349
  • 4
  • 19
  • 30