Nathan said:
Hi,
This has been mentioned in these groups before but I have never really
found an answer that satisfies me. And I am sure I will get differing
answers this time as well.
Should the Local and Domain Administrator passwords be different?
I have a feeling the answer will be yes.
Thanks
Of course I am going to say yes.
That is not why I decided to finally respond, however.
Think of the situation this way. You have a fairly large amount of
infrastructure. Any one of the machines recognizes its uber-master,
based only on whether it is a member of the Administrators group
defined on itself (or is System).
So, what you are actually asking is along the lines of
"How should I segement up this infrastructure so that, if one of
these uber-masters gets compromised, I can live with having that
entire segment placed at high peril?"
In the extreme you might say, minimize the ability of fire to spread,
which would mean each account uber-master has unique creds.
In the extreme that means somewhat more uber-master creds to
track than machines, which itself becomes a problem.
So, your task is to determine your tolerance for exposure, where
the segmentation boundaries should be (draw the firebreaks), the
frequency of change of creds, etc. all in order to keep the risks
from your choices contained.
Now, a further observation. If member servers and/or client
machines are managed with machine local admin accounts, then
those are stored in the machine's SAM - which means these can
be fairly accessible to "rightful users" of those machines under
a number of scenios (most involving misconfiguration or unpatched
flaws). If on the other hand, the uber-masters of the members are
only domain accounts, this SAM risk is removed; but the machines
become serviceable (depending on existing caching) most reliably
only when network connected or when the (one?) local admin
account is used. However, if Domain Admins are used in the
environment, compromise of one of these is catastrophic - hence
I would say DA should be used ONLY when there are no real,
reasonable alternatives. For example, the client machines of one
segment should not be routinely managed with a DA account (!)
but with domain account(s) defined for that client segment.
Also, if the machine local account is not strongly secured, or if
a uniform password is used over a segment of machines, then
what has been accomplished ?? Crack one SAM and access
the whole segment (depending on config, this might have to be
at the physical console however, or even only in a safe mode
boot). So, what does one do? Make unique-per-machine
admin passwords and have a way to do a look-up of these if
and as they become needed due to network unavailabiltiy ?
There are many choices - and these trade off daily operational
"simplicity" with configuration to effect "greater simplicity" of
any potential future recovery needs (segmentation/containment).
