Many organizations implement strict access control to privileged accounts in their Domain and on their Windows Workstations and Servers. They work through a stringent process, ensuring local and domain user accounts have the least amount of privilege possible, lessening the possibility of exploits gaining control of systems.
However, the downfall is that a good percentage of organizations keep the same Local Administrator Account and Password combination for all Workstations. The defence, when challenged on why this is done, is typically along the lines of “we only have a handful of trusted staff that use this account”. In these cases, there is typically no auditing of which staff member used it, when and on which workstation. Key users are also typically entrusted with the generic Local Administrator account so that they can assist Support Teams (when they’re overloaded) by installing and trialing software. All of these scenarios provide the potential for rootkits, keyloggers, and other suspect services being installed without your knowledge.
With Passwordstate, you can easily setup unique Local Administrator and Password combinations for each host, audit and report the access to these accounts, configure Check In and Check Out so only one person can access the account at any point in time and setup scheduled password resets to limit exposure. Enabling PowerShell Remoting is a prerequisite required for this and you should understand the implications of doing so. Microsoft provide a good summary that can be found by searching for “PowerShell Remoting Security Considerations – Microsoft Docs”.
Discover All Hosts and Local Accounts
First, you’ll need to setup a Host Discovery job, identifying all your workstations and adding them into Passwordstate. In the example below I’m identifying all of our Windows 10 Workstations using the following Host Discovery Job.
As you can see from the above image, I’ve targeted the Windows 10 Operating System on our Domain and have specified a Privileged Account with permissions to query Active Directory for this Discovery Job. I’ve also simply selected the CN=Computers (CN being Common Name) on the active directory ous tab. It’s a good idea to initially run the query in Simulation Mode to make sure it’s returning the results you were expecting. Once you’re happy with the result you can unclick Simulation Mode and run the discovery job. You can also specify the frequency of the Discovery Job on the schedule tab. I’ve added in the results of the discovery job to the Hosts tab under a folder called Halox Workstations,
Next, I’ve created a Shared Password List called Local Windows 10 Admin Accounts. This will be used to store the Local Admin Accounts for the Windows 10 Workstations that I’ve added in. In the Password List I’ve selected Enable Password Resets and set the Default Password Reset Schedule to resetting every 90 days. On the customize fields tab it’s worth checking that the Expiry Date field is checked as required as this is updated with the new Expiry Date for the Passwords.
You can also specify the Password Strength Policy and Generator Policies in accordance with your organization’s standards.
Now you can setup the Local Account Discovery job. As per the image below, this discovery job will import all Local Accounts that are members of the Local Administrator’s Group on all Windows 10 Workstations and store the password records in the Local Windows 10 Admin Accounts Password List. You will need to specify the hosts to interrogate on the hosts to be queried tab. Again, you can run this job in Simulation Mode to ensure you are targeting the right machines and verify the results before actually importing them into Passwordstate. Note, If PowerShell Remoting isn’t enabled on the remote systems then you won’t be able to query the Local Administrator accounts on the target hosts.
Schedule Password Resets for Local Accounts
Once you’re confident you are obtaining the right results you can also elect to perform an immediate Password Reset for these accounts by selecting the radio button (bottom of the image). This enables you to bring all the imported accounts under control and reference Passwordstate as the single source of truth for these Local Account credentials.
Alternatively, you can go back to the Password List that the records are being stored in, and from the List Administrator Actions… drop down select Bulk Update Passwords,
When using either the immediate Password Reset or Bulk Update Passwords the Expiry Date will be updated in accordance with the number of days specified under Default Password Reset Schedule to enable future Password Resets to occur correctly.
Enable Check Out and Check In for Local Accounts
Lastly, we’re now at the option for Check In and Check out. This is extremely useful in offering a tight granular control over access to Local Accounts across your workstation fleet. To enable this for all Local Accounts you’ll need to modify the Local Account Discovery job you’ve previously created as follows,
This will now generate a Random Password for each Local Account that is imported, perform an immediate Password Reset on the Host that the Local Account belongs to, and specify the Security Settings of each Password Record limiting access to the password via a Check Out process, immediately perform a Password Reset on Check In and automatically Check In passwords after 12 hours (in case your System Admins have forgotten to). Anyone requiring access to a Checked Out Local Amin Account password will only be able to see who has exclusive access to this credential. All events are of course audited.
You can watch our YouTube video showing the Check In and Check Out functionality here.
We hope this information helps you to understand what options are available to better control access to Local Accounts and improve on your security posture. All feedback is welcome as always via support@clickstuidios.com.au