Disable domain administrator account?

[JChester42]

We recently disabled our domain builtin administrator account in active directory, to harden security
We have 5 Domain controllers. It appears after we did this, we starting receive error messages in event viewer:

Event 40960
The Security System detected an authentication error for the server ldap/name.name.com/name.com@name.com. The failure code from authentication protocol Kerberos was "The referenced account is currently disabled and may not be logged on to.
(0xc0000072)".

We also received errors in DHCP service on some servers, stating that they didn't have right credentials for replication.

It doesn't appear that any major apps went down, but these message do alarm me, that maybe things are not getting replicated.

 

[igmp]

I think it's because on your network you have certain services runing with domain administrator account.

 

[JChester42]

How can you tell which services are running as domain administrator, and where would I go to change which account they use?

 

[ScottCr]

click start run and type services.msc

The 5th column tells you the account used. To change it double click on the service and go to the log on tab.

http://scottcross.blogspot.com

Windows and NT Admin.

 

[JChester42]

I looked and I have no services running as Administrator.

All services are either running as Local System, Or Network Service.

 

[nsantin]

Just curious, why did you decide to disable the account? An easier trick is to rename the account then create a new domain account named administrator that has guest access.

This way if someone attempts a brute force attack on the administrator account the best they will get is a dummy account if they succeed. Plus you don't get stuck trying to hunt down any services that use the admin account as they use the GUID not the name to identify it.

 

[JChester42]

Well, I was told it would be best to disable admin account and create a new one, because they could still attack the account since the GUID doesn't change.

 

[wasisnt]

I always rename mine just so I can have it active "just in case". Just make sure to note the new name and password!

http://www.onlinecomputertips.com