Password Security and Network Administration

Anyone out there have situations where they need to be able to login as a particular user on their network for troubleshooting purposes? Make the situation even more sticky when that person is not in the office. That person's station is locked out with password protected screensaver (WinXP or Win2K.) That machine is running a three day select or load on a database of ten million+ records.

As network admin I can go ahead and login to the machine as domain admin user - no problem - except that this three day select or load will be halted. The results of this process are my company's bread and butter so it cannot be halted. Not to mention the possibility of corrupting data by stopping the process midstream.

I understand the fundamentals of password security. From all I read, each user is to have a private password "X" number of characters alpha, numeric, capitals and symbols, non dictionary blah blah blah. The user is also to have complete control over their password and it is not to be shared with anyone. The list goes on and all of it I understand.

How would you address this situation in a network with 100 unique logins any of which I may need access to at any time as the user who normally sits at that station. Do you recommend a separate database of users' passwords encrypted and accessible only to domain admins? Does one just throw their hands up and say that nothing can be done until that person returns?

Any recommendations of experience that you can share would be greatly appreciated.

Haknwak

Create a regular user for maitaince. Make it a default part of setting up the machine.

Geric - that already exists - domain admin (me) can login to any machine in the domain as himself. Problem is that all processes running under the old login are stopped - that three day long database load - that's what cannot happen.

Also - there are oftentimes security related problems with a particular user - problems best troubleshot by logging in as that user and trying things. Maybe rights to shares, other servers or domains.

Just a suggestion, You could try to run the processes under a local system account rather than a Domain\User account.If that doesn`t work for you, try to run under a Domain\group account where you and the user are part of the same group.
Is the database that you are working with a M$ SQL database??

yes it is - but in microsnot's wonder of "security" when an XP or win2k machine is locked the ONLY way to unlock it AND ensure that all running programs continue is to unlock the station as the same user that originally ran the program.

Effin Blows!!

Gotta be some security precedence for this somewhere. Wonder how NASA or DOD handles situations like this?

Post this question to the news group microsoft.public.sqlserver.server

Unfortunately, I don't think there is a legal way of doing it without having the user's conscent ! Even if you are a Administrator of the domain.

Have u tried to change password on the domain and to see if this could help ? I'd be surprised though since I think that the token having the password and all as to be remake on the next user login or establish a password change by the user itself.

I don't know, but is there a law that could permit you to get your user sign a kind of legal conscent that when this kind of situation happens, they'd let you use a software like @stake LC4 to get their current password and then unlock their station and finaly make sure to inform the user of the changes made to their account ? If so, here's your solution...

Good luck !

IT CAN'T BE DONE!!!!
If you log in as anyone other than the idiot who decided to run the program, Windows will kill the program and I wouldn't want to bet that it will be elegant.
You have to go to the server and kill the process at the server.
We used to run SQL server (now using PostgreSQL). The nice thing about SQL is that if it is done correctly the data stays intact; of course with Micro$oft that could be an issue.

You could also talk to your boss about implementing assigned passwords to users which they cannot change. That would give you access to each account (since you know the passwords) and it would also ensure that they are using a "secure" password. That would be my suggestion.

Not sure if this would work on a windows system (since I work in a unix/linux based environment) but couldn't you also change their password on the server then use that password to login to the machine and have them change it to whatever when they return?

Hope this helps a bit.

why not run the long process as a daemon...err. system service for windows. thus avoiding the logged-on process dependency.

it seems that i got a gray with no description for my last suggestion...i have no idea how to interpret that feedback.

- so i'll provide another option.

if we're talking about ms-sql then the query could be built into a dts package and scheduled - so that client interaction (workstation in question) is not even needed. the same can be done with pl/sql and cron (there might even be an oracle internal mechanism...i'll never claim to be an oracle guru).

and while we're at it...

you could deploy your own gina implementation such that multiple terminals are supported locally. this is more of a development solution rather than an administrative one - but hey whatever works.

Quote:

---

Originally posted here by DBEAUCHAMP
Unfortunately, I don't think there is a legal way of doing it without having the user's conscent ! Even if you are a Administrator of the domain.

---

Actually, I don'T think cracking users passwords is illegal if you are the admin and have the appropriate authority: the network and systems are property of the company, as well as all the work done on them. You should probably specify it in the policy though so users know...

Quote:

---

[i]
Have u tried to change password on the domain and to see if this could help ? I'd be surprised though since I think that the token having the password and all as to be remake on the next user login or establish a password change by the user itself.
[/B]

---

I'd be intersted in hearing the results of that... (Heck, I'll try it monday when I get back to work..)

Quote:

---

[i]
I don't know, but is there a law that could permit you to get your user sign a kind of legal conscent that when this kind of situation happens, they'd let you use a software like @stake LC4 to get their current password and then unlock their station and finaly make sure to inform the user of the changes made to their account ? If so, here's your solution...
[/B]

---

Like I said, no law are against it since the company owns everything and you are authorized as the admin to do that. It doesn't constitute unauthorized access, theft of data or anything...

Good luck ! [/B][/QUOTE]

For my part I'd suggest trying to run such scripts as batch jobs (ie: through the task scheduler for example. ) so they don't run as interactive and wouldn't be ended on logout (I'm not sure but I think it should work... and it's probably worht a try...

(this might give hints: http://www.microsoft.com/technet/tre...d_urs_wyxu.asp)

Ammo

Thanks for all the suggestions. I'll try and address your responses individually.

- We used to have a system whereby I set all the passwords. New security policy. No more.

- legality of password databases - I don't think it's illegal - the data is the company's and they (I as admin) have rights to gain access to it at any time if need be under our security audit

- make the program run as a service - Bwahahaha - No offense but that would mean our programming team would need to do their job right the first time

- cracking the SAM - I could do that, but some security officer - the ***** - (me) set a strong password policy of min of 8 characters, three of the following four - upper case, lwer case, numeric and symbol. Most passwords are 10+ characters. It takes even l0phtcrack days just to come up with a couple passwords. Plust the ******* (m,e) set the polict to have 30 day turnaround on password changes, uniques with a history of five previous passwords.

Customers are a little picky on just who and when people access their databases, Very sensitive as of late with the larger customers and their security audits.

I decided the following - if someone leaves fr a while and i have legit need to get in to their computer - tough **** if they didnt save their work and ..

if the network problem is so huge that I need to stop programs from running, in all likelyhood the database server is puking already. Tough noogies if they have to rerun a three day load. They'll get over it. My primary objective is to protect the servers.