Best Practices for Administering Servers with LAPS
Asked by
TechieDude42
I'm curious about the best practices for managing servers, especially with Local Administrator Password Solution (LAPS) in the mix. I've learned that LAPS automatically rotates passwords, which makes it tricky to handle local server administration without using a Domain Admin account. Using Domain Admin for server tasks seems risky, especially since we have some legacy Server 2008 systems that are critical for our operations. I'm wondering how others approach this. Do you all create dedicated admin accounts? Is the local admin account usually disabled? And how do you balance security with LAPS? My setup is entirely on-premises with two domain controllers.
Answers
Definitely create dedicated admin accounts for each admin, it helps keep things organized and secure. This way, you avoid using Domain Admin for day-to-day tasks. Plus, we’ve got a system in place where CyberArk rotates the passwords for us, and everything is monitored by our security team. We strictly use LAPS for the endpoints, but keeping separate accounts for admin tasks is crucial in my opinion.
Reply to this answer
Managing with local accounts in a domain setup isn't the way to go at all. It’s best to deploy accounts using a Restricted Groups GPO to ensure proper permissions. Members of the Protected Users group are safer and more compliant with current security practices.
Reply to this answer
We use Just-In-Time (JIT) elevation for accessing Domain Admin functions. Each server has its own dedicated admin group, and those accounts are added to the local administrators group. It’s also worth mentioning that we enforce MFA for RDP access, which adds another layer of security.
Reply to this answer
You should really avoid using Domain Admin accounts for server administration outside of specially designed jump hosts. Ideally, every admin should have a personal user account for daily tasks and a separate admin account strictly for server management. Yes, it's a hassle juggling multiple accounts, but it significantly improves security and mitigates risks.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions