renaming administrator name in windows 2000 server

  • Thread starter Thread starter Haidi
  • Start date Start date
H

Haidi

Hi,
somebody told me to rename the administrator account name
for higher security. how far is this information true. as
far as I also know, that if I do this the Recovery Console
will never work if the administrator name is changed.
Haidi
 
Hi Haidi. This is one of the best practices for secure Active Directory is
recommended, and provide a more secure deployment of Active Directory. I'm
not 100% nut al most sure the recovery console will use the local
Administrator SAM Account for the recovery console because Active Directory
are not running in Recovery Console Mode.

Have a nice day!
 
Thanks Christoffer, I will also try to simulate this
exercise, although it requires some resources, and if I
come to solid conclusion; I will post it.
:)
 
Correct, the recovery console uses the local SAM 'Administrator' account and
if you rename the AD Admin the local SAM account is still called
'Administrator'.

Renaming the Admin account is a fallback to the Un*x days when everyone took
time out on their donut breaks to throw the dictionary at the SU command.
Everyone knows that on a W2K system the 'Administrator' account is boss, so
if they're gonna try and hack one they usually try that first. The actual
security of the acct is entirely down to how complex your password is
('password' gets you fired, '7t7f78 f78FV^*CR^**_C&G"£&(!"Tu' gets you
promoted) so Admin is no easier or harder to crack than any other, but the
'benefits' to a blackhat are greater.

The usual hardening routine is to rename Admin to something else, then
create a plain old user account called Administrator and set Deny All in GP,
so it's effectively useless. Then you can still log hack attempts but you
know they can't get anywhere if they guess the name of your Mom's dog.

Another area to watch though is service accounts. Often apps like backup,
email and SQL require local accounts with non-expiring passwords and local
system permissions - they are the ones that the true blackhats go after, as
many sysops can't tell a legit system account logon from a hack.

~A~
 
Back
Top