Recovering a password in Active Directory

[ScottWIT]

I come from an environment where I stored the user passwords and knew all of them... now however I'm at a place where the users are creating their own passwords and I have no list of them. I need a way to find out various passwords at times for obvious reasons. What is the best way to go about doing that in AD instead of just resetting them?

 

[lhuegele]

I can't think of any "obvious" reasons to need to know someone's passwords. Can you explain further what these "obvious" reasons are?

Domain administrators can log-in and see anything on any device on the domain, so there really is no reason to need someone else's password.

 

[ScottWIT]

Haha... I am getting the feeling you think I am not a Network Admin. I am, but I freely admit I'm still new (3 years into it) so I likely don't have all of the knowledge you do yet which is why I'm asking this question.

Here's an example... I started here 5 months ago and somebody today asked me the password for a login that was created before I got here. It's a login that tech support people will use on occasion. I didn't know it so how can I find out without resetting it?

 

[58sniper]

you don't. Reset it if needed.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP

 

[ScottWIT]

ok, if that's the general thinking among most admins then i'm fine with that. the only risk is if i reset a password on a login that is still active then they will be locked out but having them call me is not the end of the world i suppose.

 

[lhuegele]

If it's a generic account that many people use, the user should be able to ask one of the other folks what the password is. Otherwise resetting it and communicating the new password to the group is the only thing I know.

Good luck,

 

[jchoponis]

i agree - the only time i use a user's account for troubleshooting is when they are present.

i make sure to tell people that i can't see their current password, but if necessary i can reset it.

i don't think it would be wise to be able to impersonate anyone on the network - there is a difference between acting as a user and having access to user resources...

 

[TheLad]

As long as it is not an account used to start a service on a server, there should be no issues resetting the password.

--------------------------------------
"Insert funny comment in here!"
--------------------------------------