Domain Security Question

[InIT4theMoney]

We run a Small Business Server with a number of Windows XP Professional PCs. All the PCs are joined to the Domain and when our users are logged on as themselves we are able to use the security settings on various server folders and other resources to grant or deny permissions normally. No problem.

Everything falls apart if we log on to one of our PCs as the LOCAL Administrator. As far as I was aware, local Admin acounts will have a different security ID to the server Admin account, the Domain Admins Group or the Administrators group. Yet a LOCAL Admin can access all the resources on the server that have DOMAIN Admins group permissions, SERVER Administrator permissions or SERVER Administrators group permissions.

This only happens when the local Admin acounts have the same password as the server Administrator account. If the local Admin account password is different then access to server resources is denied. (A pop-up box asks for a user name and password).

My question is: How can a password override the underlying security identifiers? The local Admin acount has no permissions set to enable any access to our server so shouldn't the server be looking at the security ID and denying permission, irrespective of the account name and password?

Any ideas or explanations would be very welcome.

Ian W

 

[Jpoandl]

It is because your admin naming and password strategy is not sound. If a user account is identicle (username and password), you will have access...as you have found. Therefore, you should not use the same username and password in your environment.

1) I would recommend changing the domain admins username and password. Keep this information private. Even create a new account called "administrator" and then disable this account.

2) On your servers create a policy where all local admin accounts are renamed to something standard "LocalADMIN" and create a standard password

3) On your desktops, create a policy where all local admin accounts are renamed to something standard "DeskTopAdmin" and create a standard password.

4) Change all of your password periodically.





Joseph L. Poandl
MCSE 2003

If your company is in need of experts to examine technical problems/solutions, please contact

http://www.NJCOMPUTERNETWORKS.com

(Sales@njcomputernetworks.com)