Active Directory Passwords

[DMWCSD]

Does anyone know if there is a way that I can either setup Active Directory to store user passwords somewhere that I can view them when needed, or if there is anything that I can do to see the users passwords?

Thanks for any help you can give. I am almost to the point where I begin to assign passwords to my users so I have a list of passwords that my technicians can use to do their jobs.

 

[xmsre]

No, by design.

 

[Digitalcandy]

You don't need to know everyone's password. If you need to get into a user's computer have the tech ask the user their password, or reset the password.


If you start assiging passwords, then how are you going to manage them when people start changing them? Are you not going to allow people to change their passwords or force changes? That's a no-no.

 

[rawle24]

it's only possible for you to reset the user's passwords

 

[compuveg]

None of these folks are right and all of these folks are right.

None of them are right unless they all have setup their Win2k3 domains in a FIPS compliant manner. I don't expect this to be the case. Password hashes are stored in a domain controller's registry, and are quite accessible and easily cracked to reveal the true password. If you do have a FIPS compliant setup, just put your servers on a hub and capture all the traffic, and sniff password hashes from that.

All of them are right in that there's no reason for you to know anyone's password aside from your own. I don't know how things are setup that this might be required. I would highly recommend revisiting what about the setup requires you to know or change ANYONE's passwords, and change it. Your techs should have accounts good enough to log off any user, and your users should be trained wel enough to save their documents often so it doesn't matter if they are forced to logoff while they're out.

Your default admin account should be renamed using policy. Then you should set that account's password to something sooo ridiculously long and complex you'll never remember. Use the help of something like randpass.com for this. Once that's set, seal it in an envelope and drop it in your offsite storage safe.

Go buy LC5 from Symantec and you'll have everything your need. LC5 is difficult to get, and only available to US/Canada residents. (It might be easier now, I bought it mid-Symantec-acquisition)

There's also a number of free utilities available that will do this, too.

 

[pinkpanther56]

Where in the reg are the password hashes stored?

 

[compuveg]

That part I don't know.

I do know that the LC5 program is very good at finding them and bringing them into its sweaty little hands.

Packet sniffing works, too, if you've got a good old fashioned hub, and no one notices the server being plugged into a 10/100 port instead of a GB port.