RE: Account lockout

["Brian Stoneburner (Postmaster)" <bstoneburner () wcisteel com>]

Alex,
        It would seem the way you are doing this has some problems.  Here is some
advice:

Create a service account to run your scripts under.
Rename your admin account and change the passowrd.  Put the password in a
safe.  Give the combination to the CIO.
Create a domain admin account for each of your admins and enable auditing.

Never setup services running from the "primary" administrator account -
always use a service account.
Use auditing to determine what is account is being logged into.  With this
information you can determine
if you have a rogue admin user.

Brian
-----Original Message-----
From: Alex Tarata [mailto:atarata () bigpond net au]
Sent: Saturday, January 11, 2003 11:42 PM
To: security-basics () securityfocus com
Subject: Account lockout


Hi all,

Im not sure if this is the right place to post this but anyway here it goes:
recently at our organization we have changed an admin password on the domain
controllers and we had to reboot all the servers involved and relog them
with the new password. All went good apart from some small things we have
managed to solve. The problem occured when some guy changed the password on
the DCs again thinking the password was wrong. When he found out that the
password was indeed right he changed it back to what it was initially. Now
we are experiencing problems with account lockouts very often. What I am
thinking is that the servers might need to be rebooted and relogged with the
password AGAIN. Is this true or should I look for another cause of the
lockout ?

Just to make more clear what we did when we changed the pass is: we changed
the pass on all the scripts using that account, checked all the services
using that account, checked all the web, SQL services that could be using
that account and also the scheduled tasks.

But obviosly there is something wrong as the account is still being locked
out. If you have any ideas please mail me as this is very important and I am
running out of ideeas.


Regards,
Alex