Danger Mouse":3ocfbz9r said:
The segregated accounts thing? Yeah, my manager ordered that. Hell, he ordered it because I recommended it and implemented it for myself. One of my coworkers responded by putting in a local admin account on every system he touched. Um. No. Just, no.
My management is unusually paranoid. Company is a managed services provider/integrator with 50 staff and whilst its not massive, its not a tiny little thing either.
The MD is so paranoid that he, and only he, has the passwords for the Administrator account, Backup Exec service account, Enterprise Vault service accounts and a couple of other key accounts that have access to everything or access to specific things. So when it came time for me to upgrade from BE11 to BE12, BE12 to BE12.5 (etc etc), I had to get him to enter in the service account every single time.
At some point, an employee (fine, me) cottoned on to how a lot of the security permissions were setup. Basically there are 2 other domain admin accounts, of which 1 belongs to the Infrastructure team and the other belongs to the Software Development team. The Software Dev account is unrestricted, but the Infrastructure team's account is given a deny permission on the OU that contains the directors accounts, administrator and other key accounts. I stupidly reported how weak this was (since you could create another account with the restricted infrastructure account, then grant it domain admin to circumvent the deny ACL), and I got lumped with redoing it all and restricting it.
So I worked out their requirements:
- Everyone, who needs it, to have domain admin accounts
- All of these domain admin accounts to be restricted
- Restrictions include to not change other domain admin account passwords, not to change management team (and other designated) account passwords, not to have access to management team (and other designated) mailboxes, not to be able to easily remove restrictions.
After a little playing around I did the following, which is my own notes to work out how to back out of what I did if I needed to:
Code:
Security Group created, called "Restricted Domain Admins":
- Create central container
- Change ownership of the container to Enterprise Admins
- Change permissions of group to enable read, deny write, deny add/remove self as member to the group (“Restricted Domain Admins”) itself
Administrative Users:
- Create/Move admin users to a central container
- Add admin users to the security group (“Restricted Domain Admins”)
- Change ownership of the admin accounts to enterprise admins
- Change permissions of the admin container to deny write access to the security group
Builtin Folder:
- Change ownership of folder to enterprise admins
- Change ownership of following accounts to enterprise admins: administrators, server operators, backup operators, account operators
Objects with specific permissions for the security group:
- AdminSDHolder (via ADSIEdit.msc) has deny write to "Restricted Domain Admins", is owned by enterprise admins
- Management and Management_Security groups have deny write to "Restricted Domain Admins"
- Director group has deny write to "Restricted Domain Admins"
- Schema Admins / Domain Admins / Enterprise Admins are all owned by Enterprise Admins to "Restricted Domain Admins"
- Administrator account is owned by Enterprise Admins to "Restricted Domain Admins"
- Management Team OU is deny read/write for the to "Restricted Domain Admins"
Now, it appeared to do what I wanted to do (except for the mail, since I needed E2010 and RBAC). I was pretty fucking proud of myself for working it out and making it hard to break out of...till I realised that I really only prevented myself since this was simply one way of doing things. I asked another engineer to break out of it, and just as he started the Infrastructure manager got wind of it, watched for literally 45 seconds and promptly told me "Implement it!!!!!!!" (that is a literal copy and paste from the email, you can never have too many exclamation marks apparently).
I had a point in all of this long winded explanation, but I've since forgotten it. Suffice to say, I'm not happy and this is a goddamn boneheaded decision because I never really got to test the impact of this on an Active Directory domain - I don't know if anything is broken as a result of all of these shenanigans
Oh and also, I've somehow convinced management in all of this to give me an account that is unrestricted in any way, shape or form - so why not just give me the damn administrator password and all the others so I don't need to wait 2 weeks (cos you're on holiday) to do upgrades that you wanted 2 days ago.
[edit]
I thought I had the point again, but no it was just this: the other problem in all of this, is that the directors don't want to let me remove the domain admin access on their accounts even though this is an IT company and they understand the risks of them operating in that fashion. WHAT. THE. FUCK.
[edit2]
I remember part of my point: I need to keep my big mouth shut.
