Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our team does not use the admin accounts (there are no anonymous admin accounts, each administrator has a designated admin account) during normal operations. Only when needed to make a change, perform maintenance etc and for off-site support we have two-factor authentication. Small companies where you have to be multi-talented, overworked and underpaid is what I am getting at :)

We recently went through an audit where there was a request for us to limit/disable the concurrent logins for admin accounts. The general idea is: how do we make it hard for a rogue admin to be malicious, and also how do we know that the logged in admin accounts are not compromised (hacker logged in with admin).

From my research there is no way to limit the concurrent logins for an account on a Windows domain out of the box? Does it require third party software?

  • Hi! Just a clarification - I assume this is about RDP logins by a single account to multiple machines at the same time? – Milen Jul 28 '15 at 11:56
  • No this is really limiting the amount of concurrent logins. Essentially they have stated no concurrent logins for admin account. While the practical side of it is still up for debate I wanted to check techincal feasability. – Namphibian Jul 28 '15 at 12:00
  • I think we're talking about the same thing, but using a different language. Let's first establish if we are talking about both remote desktop and local interactive logins? – Milen Jul 28 '15 at 12:02
  • @Milen I clarified this with the auditors(non-technical) people and they want me to disable concurrent logins for admin accounts thus no more than one connection ever regardless of type. I know this does not make sense at all but I need to get back to them regarding feasibility. – Namphibian Jul 28 '15 at 21:09

so I don't think this is going to be 100% possible.

What you can do is limit your servers to a single RDP session : https://support.managed.com/kb/a1816/how-to-enable-disable-multiple-rdp-sessions-in-windows-2012.aspx

What you won't be able to prevent (I don't think) is someone using a console session at the same time (so MSTSC /admin) and the equivelent physical access console session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.