Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Computer Accounts and Authentication Controls

Computer accounts are also security principals. Therefore, no study of Windows authentication or Windows administrator should ignore them. You should understand how computer accounts are created, how their passwords are modified, and what you can do to affect account processing.

Computer Account Creation and Passwords

If a computer account has not been prestaged (created in the Active Directory prior to the computer joining the domain), an account is created for the computer when a Windows NT 4.0, Windows 2000, Windows XP Professional, or Windows Server 2003 computer is joined to a Windows domain. The computer account is placed by default in the computer's Organizational Unit (OU) but can be moved to another OU. (Windows 95 and Windows 98 computers cannot join a domain, although users with valid domain accounts can log on to the domain from these computers.) The domain controller creates a password for the computer account, provides it to the computer, and places its hash in the Active Directory database. At all future restarts, these credentials are used to authenticate the computer to the domain and download its security policy. The password is ordinarily changed every 30 days by the computer and sent to the domain controller.

Computer account passwords are very strong. They are created and managed by the operating system. You cannot directly modify them. However, I also have not found an application that can crack or otherwise deduce them, and even if you could determine a computer account password, you could not use this credential to "log on."

Computer Account Processing Manipulation

You can manipulate three controls that affect the computer account processing. First, by default, domain users have the right to join up to 10 computers to the domain. This user right can be extended in Group Policy by giving a group of specific users the right to join any number of computers to the domain. Second, by prestaging computer accounts, you can restrict which users can join which computers. By moving computer accounts to specific OUs, you control the security settings for the computer. Finally, you can prevent computer account passwords from changing. Although this is not a good security practice, if you have computers that are not in constant communication with their domain controllers, the computers may eventually find that they no longer have a valid password and cannot authenticate to the domain.

In addition to manipulating controls, you can affect computer account processing by placing the computer account in an OU. The computer account OU location determines the GPO that will apply to it. GPOs set specific security policies for the objects within the container that the GPO is linked to.

To manage the right to join computers to the domain, you add or remove user groups from the Group Policy-based User Right: Add Computers to a Domain. User rights are located in the Computer Configuration, Windows Settings, Security Settings, Local policy section. This change should be made in the Default Domain Controller Policy for each domain you want to manage.

To prestage computer accounts, follow these steps:

Choose Active Directory Users And Computers from the Administrative Tools menu.

Navigate to the container (OU or Computer) where the computer account should reside.

Right-click the container and select Add Computer Account.

Type the Computer Name and the User Or Group account that is allowed to add this computer to the domain, as shown in Figure 2-10, and click OK.

To prevent computer passwords from changing, perform these steps:

Open the Group Policy Object linked to the container that manages this computer account.

Change the security option Domain Member: Disable Machine Account Password Change to Enabled. The computer will not attempt to change its password.

WARNING: Don't Disable the Machine Account Password Change Security Option

Ordinarily, you should not change this option! It is a good security practice to ensure that computer account passwords are frequently changed. If you have issues with password synchronization, you should first try to resolve the issue by modifying the number of days between password changes using the Domain Member: Maximum Machine Account Password Age security option.

TIP: Don't Be Confused

The language used in many security settings can be confusing. Make sure that you read them and understand them in context. For example, if you want to use the security option Domain Member: Disable Machine Account Password Change to prevent computer account passwords from being automatically changed, you might think you should select Disabled. However, if you read the Security Option statement carefully, you'll see that this isn't the case. Instead, you enable the disablement of computer account password change. If you disable a disable, you would be enabling account maintenance. This is awkward, but this is the way it is.