We have a setup where if a user gets locked out of their Windows machine, then their department or assistant manager can unlock their account. We are being asked to expand this so that any employee can unlock another employee's account.
Note: We have a script that can unlock a user which can be run if you are in the correct AD security group.
This strikes me as a bad practice. Should this be allowed? If so, why?
Allowing any user to unlock another is definitely not a best practice and introduces the risk that use of "the script" could allow potentially unauthorized unlocks to occur undetected (e.g., malicious attackers performing password guessing). For example, if an attacker is guessing passwords and locks out an account and the real owner asks a co-worker (non-IT / manager) to unlock it, the intrusion attempt may go undetected. IT/Managers "should" be trained to be on the alert for suspicious lockouts with unknown root causes.
That said, there is some validity to the comment that in a small organization this might be acceptable, but doesn't scale well from a security POV in larger organizations. If the org is going to move forward with this practice, there should be some level of security awareness training that accompanies its use, and perhaps a procedure for manual documentation of events or automated logging (and subsequent review of said logs).
