Thursday, 26 April 2012

Video: Crack the Cred: Get into a Windows System/DC when the Domain Admin Password is Unknown/Lost/Changed

Fellow MVP Dana Epp goes through the steps to change the domain admin’s password on a DC where that password is not known or lost in episode 105 of Crack the Cred.
image
If there is a newer episode on the site then hover over the Playlist to get to episode 105.
It is very easy to do.
This is five minutes of any IT administrator’s life that is well spent. Period.
As Dana notes, the only way to protect that DC is by having the system partitions encrypted by BitLocker. Physical security for that DC is a close second.
We explain this situation to all of our clients and potential clients as a part of our IT Solutions Vision. Securing their systems is always a part of the conversation especially since many folks have those servers running in closets that are shared with anything from copiers to stationary!
Awesome job Dana!
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book
*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.
Windows Live Writer
at

3 comments:

  1. Doug H.26 April, 2012 22:09

    WOW.

    1) He makes a great case for BitLocker on Domain Controllers, especially if physical security is in doubt.
    2) This reinforces why Read Only Domain Controllers instead of full DCs are better for branch offices.

    ReplyDelete
  2. Gantry30 April, 2012 07:57

    So would this technique work on a standalone 2008 R2 system, such as a Hyper-V host?

    ReplyDelete
  3. Philip Elder Cluster MVP30 April, 2012 09:58

    Doug,

    Physical access is the end of everything full or read-only.

    Gantry,

    LockSmith would work just fine. See episode 4 on Dana's site.

    Philip

    ReplyDelete

NOTE: All comments are moderated.