Password control 1

[Gardener1]

We have 6 admins one per site. the problem is they are making changes to AD and other devices with out anyone knowing about it, if there change works the go to the top of the hill and shout it was me that fix the problem, if their change breaks something they do not tell anyone and act like they did nothing. How does your companies control the changes and password.

What we would like to start doing is use a change management form to be filled out by anyone needing to make changes, then we will give them the password when they are done we will change the password. what do you think?

 

[dberg35]

Being you are using AD then you can us Group Policy and delegate permissions to the admins that only need what you give them.

 

[Roadki11]

Make sure each admin has a unique username and password. Do not allow admins to use the Administrator account. Crank up auditing. Use a 3rd party product like Netwrix Active Directory Change Reporter, and Group Policy Change Reporter. Those products are freeware and payware, the freeware doesnt tell you who did it but it will tell you what was done.

http://www.netwrix.com/active_directory_change_reporting_freeware.html

http://www.netwrix.com/group_policy_auditing_change_reporting_freeware.html

RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[SIO3]

Are you the administrator of the Parent Domain?
Then you can you can try this.

If the site admins are meant to administer specific roles, then restrict such admin to that role only - say DNSadmin etc.
Then change the Domain Administrator's password.

 

[Gardener1]

How do you guy/gals setup your IT staff. all of ours staff has domain admin.

1. we have helpdesk support (only work on computers)
2. we have site admins (now need to allow these users to change anything in AD.

 

[Gardener1]

Can you give me some hints on how to use GPO to setup the admins so that they cannot make any GPO changes?

 

[dberg35]

Check this out it should give you all the info needed.

http://technet.microsoft.com/en-us/windowsserver/grouppolicy/default.aspx