Domain Admin password change and services

[Virtualp]

Hi,
I need to find out what services are using the domain admin account due to a requested password change. This is a mixed environment of NT4, 2000, 2003.
Does anyone know of some shre/freeware that will scan the Servers and advise all instances of services using the domain admin account?

Thanks

 

[SimonDavis]

Don't know of anything, but if memory serves (I run 2k servers nowadays), a quick scan of the services running on the machine will have a 'log on as' column that specifies if its the localsystem, or another account using the service. Then you just change the ones that are logged on as admin.

Probably not so helpful if you have 90 servers, but it isn't a time consuming excercise.

Watch out for things like backup agents too, if they use the admin account, they'll have problems that won't be obvious. I doubt any software package will be guaranteed to catch all of those.

 

[AndrewTait]

In order to avoid this in the future, anything which uses the admin accounts should be set up to use a different account.

E.G.
Administrator is the main admin account. This account has an enforced password change every 30 days.

~backup001 is an account with admin privilages for backups and has a documented strong password

~serv1ce is an account with admin privilages for a particular service to run on bootup and has a documented strong password

The none alphanumeric characters make it harder to guess what the account name is, and a strong password should always be used.

Andy





He's not the messiah, he's a very naughty boy (Monty Python's The Life of Brian)