How do you secure service account password on enterprise windows enviroment?

Question

I'm suppose to have a large environment ( 500+ servers ) all Windows based joined to Active Directory domain.

Some domain accounts are used for application\middleware authentication that needs high privileges (domain admins).

I would like to secure such accounts as much as possible. The password is known to restricted users but anyway not so much restricted ( as servers are managed by an outsourced provider). Changing the password seems a nightmare due to difficult to evaluate impact on services.

Is there any technology I'm not aware of to manage in secure way these sorts of password changes?

Answer 1

Jason Fossen, the SANS instructor for SEC505, posted a great article about this (below). While the topic is for local accounts, one could use his script for domain accounts as well. He also mentions some of the commercial solutions too.

Reset Local Administrator Password Using A Different Random String On Each Computer And Recover The Passwords Securely