Dealing with untrusted administrators in a Windows domain

Question

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login as someone else.

A domain admin is all powerful, and can do a variety of misdeeds, such as changing someone's password and misrepresenting himself as him/her. He can also clear the logs, leaving no trace of his actions.

So, my question is:

1. Is it possible to force actions like "reset password" to require the approval of more than a single administrator?
2. Is it possible to audit actions in way that the domain admin cannot tamper with them?
3. Do you suggest any other approach to deal with environments with untrusted admins?

Answer 1

The answer is simple: do not allow Domain Admins. Give access to specific functions to specific people who are in the job of administration. The "Domain Admin" group should be empty with alerts when a user is added to this group.

In small teams, this might be a little tricky, but you can include people outside of the IT admin staff for oversight, and you can create a scheme to make sure staff only gets a part of the privileges necessary to prevent tampering.

1. Give password management to a user who can only log into a single machine, and audit if other users log into that machine.
2. Allow log access to a person to someone who cannot change user accounts
3. This is the principle of "Least Privilege" at work, which is how you deal with any level of 'distrust'

Answer 2

1- Is it possible to force actions like "reset password" to require the approval of more than a single administrator?

Its good idea to separate the creation of users from password reset, you could assign user creation to an admin, and leave the password reset to Help Desk for example.

In active directory you don't need domain admin to create users, you can create an user group with specific account access, thats nice about AD, permissions are very granular.

2- Is it possible to audit actions in way that the domain admin cannot tamper with them?

Yes, if you dont have a logging solution (as i may recommend you to have a log server) you can configure a file server with create only permissions to admin, and configure your server to put the log files there, thats an option. Also use GPO settings to control the audit of the windows machine.

3- Do you suggest any other approach to deal with environments with untrusted admins?

• Use two factor authentication.
• Use session recorder software and keylogger.
• Log everything in a separate server, encrypted and tamper proof.

Answer 3

Comrade Sadaeq,

One of the fundamental tenets of security is that you cannot protect a system from the administrator of the system itself. This is because the administrator has the means to modify/control the system, so he can always find a way to access anything he wants.

My advice to you would be to advise your client to reduce the number of their domain admins to a realy small number of people they can trust. As suggested by comrade Schroeder, it is always best to delegate other parts of system management to other delegated admins based on a good delegation model.

One thing to keep in mind about delegation in Active Directory though is to make sure that the Domain Admin accounts are not in the same OU as other accounts, because if so, and you delegated administration of that OU to a delegated admin, that delegated admin could use permision inheritance to grant himself enough permissions on the Domain Admin account to reset the Domain Admin's password and login as the Domain Admin. (This concept is not new and is known as "Active Directory Privilege Escalation")

So comrade, my suggestion is to reduce the number of Domain Admins by delegating all other tasks (e.g. account creation, OU management, group membership management) to other delegated admins, and only make those people admin who you can completely trust. (As suggested by other comrades, neither logging nor auditing protect a system from a Domain Admin because a Domain Admin can turn them both off.)

Good luck to you.