Re: Removing Local Admin Accounts - What do you think?

["Chris Barber" <cmbarber () gmail com>]

Rob,

Renaming the Administrator account is good enough to fool the honost
people, but seems to give managment that little warm fuzzy feeling
that they all like to have.  So it has become part of the "Best
Business Practice".  I have not tried this in a while but I do not
believe you can delete/remove the local Administrator account, so
renaming it is the best you can do to allow it to "blend in" as much
as possible.

Set the password to some ridiculously long complex randomly generated
passphrase (not password).  Lock up the password or distribute parts
to different people.  Create your own "Administrator" account and add
it to the Admin group.

Remember that Administrators should always have 2 accounts, their user
account and their Admin account, so a typical workstation may have the
following local accounts:

John.doe (renamed administrator account)
Jane.doe (my admin account)
Joey.doe (my local Administrator account)
Sam.smith (my user account)

Hope this helps,
Chris.

On 1/13/08, Rob Thompson <my.security.lists () gmail com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dear List,
>
> I am looking for a general consensus from my peers.  If you are able to
> answer this with definite knowledge and not an assumption and you fully
> understand what you are saying, please reply to this message.  I do not
> mean to be rude, but if you are not sure, please do not respond to this
> message.
>
> I am asking this as I will be presenting this to a company, as they have
> proposed this idea and I want to show them exactly what they are
> considering getting themselves into.
>
> What is your professional opinion on removing the local administrator
> account?
>
> Does this pose a security risk to have a local administrator account on
> a computer, so that IT staff (which are the only people in the
> organization that are entitled to this user/pass) can do work on a
> computer in a way that can not be "securely" audited?  What I mean by
> this is, they all use this one account (for emergencies only), instead
> of using their own credentials over the network - thereby showing the
> local admin account was used, but not who used it.
>
> What are the risks involved in removing this account?
>
> Is this a general best practice, from a security point of view?
>
> If not, what is the best practice from a security point of view?
>
> Lastly, do you believe or not, that if the IT staff wanted to compromise
> a box, anonymously, would they really need this local administrator
> account on the box?  Or would they still be able to do this, without the
> account there?  Why?
>
> I sincerely appreciate your time and thank you in advance for any
> answers that you may pose.  Also, if you see something that I did not
> consider in my questions, please feel free to include that as well.
>
> Please remember, if you think that this is a wise decision or not,
> PLEASE state your answers and why.
>
>
> - --
> Rob
>
> +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+
> |                         _   |
> |  ASCII ribbon campaign ( )  |
> |   - against HTML email  X   |
> |                        / \  |
> |                             |
> +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (MingW32)
>
> iEYEARECAAYFAkeKZCsACgkQcfN68iZZIcf9SgCgii4WMWjE8upNop/TvA41sqpJ
> 2GgAoNnC7iU1OT8GAPVkouK0UlfHfqkN
> =67NY
> -----END PGP SIGNATURE-----