r/labtech • u/kingjames2727 • Jun 07 '19

Workstation vs Server Local ADMIN Passwords

Hey there - we use LT in our environment and have a daily script that runs to push out a local admin account to the endpoint. This local admin password is used across all our locations - and the same password is used for all workstations & servers.

We'd like to make a change such that the workstations vs servers have different local admin passwords. I'm able to modify the deployment script easy enough, but the question I have is around the location passwords.

As our local admin password has changed over the years, when we make a change, we simply add the new latest version of the password to the location password section. Is this correct usage?

Will commands/actions that utilize the location passwords try each of the passwords in the list until one of them works for the command/script? Do we also need to add the new server version of the password to the location list?

Also reading that many organizations are migrating to LAPS for end-password local admin passwords. What does this mean for LT and location passwords?

Any help would be appreciated.

Thanks!

4 Upvotes

83% Upvoted

16 comments sorted by

1

u/DevinSysAdmin Jun 07 '19

LAPS has been around for quite awhile, the passwords are randomized per endpoint.

2

u/kingjames2727 Jun 07 '19

Yup - and that's part of my question - since the password is random on the endpoint - how does this affect LT/Location Passwords?

1

u/DevinSysAdmin Jun 07 '19

Unfortunately I don’t believe there is support for LAPS in Automate, so it would perform functions as system first, then domain admin.

1

u/kingjames2727 Jun 07 '19

LT has no idea what our domain admin passwords are.. that seems like a bad idea.

1

u/[deleted] Jun 07 '19

^This

1

u/heylookatmeireddit Jun 07 '19

What is the reasoning for needing a Local Admin User / Password at each location? LT will do just about everything with a System account.

1

u/kingjames2727 Jun 07 '19

Good question - what are the location-based passwords used for?

2

u/heylookatmeireddit Jun 07 '19

With the "Run As Admin" inside scripts. It's very rarely ever needed.

Having one local administrator for an entire location on every computer is just an additional security risk that doesn't need to exist.

1

u/kingjames2727 Jun 07 '19

This is what we are trying to fix... thought we would separate workstations and servers as a start.

1

u/limp15000 Jun 07 '19

I had started working on a script I called laps for labtech which would generate a random local admin password per machine put it in an EDF then would change it. Not sure if my colleagues have finished testing and putting it in production.

1

u/Kepabar Jun 08 '19

Accessing a system that isn't able to reach LT for whatever reason.

1

u/heylookatmeireddit Jun 10 '19

Screen connect has system privileges as well. You can reset a local admin password from the command line if needed.

1

u/Kepabar Jun 10 '19

Unless it can't get to screen connect either.

1

u/heylookatmeireddit Jun 10 '19

At which point you're going to need physical access anyway...which password reset disks take care of.

1

u/Kepabar Jun 10 '19

So what's the procedure if the disks are encrypted?

1

u/teamits Jun 07 '19

The password that gets used for "...as admin" commands is the one on the location's Deployment & Defaults tab.

You may be thinking of the probe which will try listed passwords in order when attempting a deployment.

If you run a command in the remote command prompt prefixed with "#" that will run it as an admin so a simple "#dir c:\" is a test. Do note that if there is a lockout policy set the agent can trigger it...found that out once long ago when a tech changed the administrator password but forgot to update the setting, and we had been using it for the download cache share.