Skip to main content

Windows Domain Admin Process

Purpose​

This solution aims to establish a centralized domain admin for each domain, ensuring a consistent and controlled approach. Additionally, the solution implements a password rotation mechanism to regularly update the password at specified intervals. This centralized approach enhances security, facilitates management, and helps mitigate potential risks associated with unmonitored or static domain admin credentials.

Update Notice: 30-August-2024​

The solution's Extra Data Fields have been renamed. Update the Windows - Admin Account - Create/Update script from the Prosync plugin and run/debug against an online Windows machine with SetEnvironment_Domain_Admin_Process set to 1 to implement the changes.

Image

Associated Content​

ContentTypeFunction
EPM - Windows Configuration - Internal Monitor - Windows Domain Admin Account ProcessInternal MonitorDetects the domain controller with missing or outdated credentials.
EPM - Windows Configuration - Script - Windows - Admin Account - Create/UpdateScriptCreate/Update the user.
△ CUSTOM - Execute Script - Windows - Admin Account - Create/UpdateAlert TemplateExecute the script against the machines detected by the internal monitor.

Implementation​

  1. Read the solution-related documents carefully.
  2. Import the EPM - Windows Configuration - Script - Windows - Admin Account - Create/Update script and run/debug against an online Windows machine with SetEnvironment_Domain_Admin_Process set to 1. This will create the required EDFs and system properties.
    Image
  3. Reload the system cache.
  4. Modify the default values for the system properties (if desired).
    Image
  5. Import the EPM - Windows Configuration - Internal Monitor - Windows Domain Admin Account Process internal monitor.
  6. Import the △ CUSTOM - Execute Script - Windows - Admin Account - Create/Update alert template.
  7. Apply the template to the internal monitor.
  8. Fill in the proper values under the client-level EDFs to enable the solution for the concerned clients.
    Image

FAQ​

Q: The solution saves the password at the client-level password tab in Automate; is there any way to sync these credentials to ITGlue?
A: Yes, the StickySync plugin can be used and configured to sync those passwords to ITGlue.

Q: Marking an EDF is not making the expected change/exclusion?
A: The EDF data might not have been synced to the v_extradatacomputers or v_extradatagroups tables. Automate runs this sync every 20-25 minutes. So, either you need to wait for 20-25 minutes, or you can run the following SQL queries from a RAWSQL monitor to force sync the data:

  • Call V_Extradata(3, 'Clients');
  • Call V_Extradata(1, 'Computers');
  • Call V_ExtradataRefresh(3, 'Clients');
  • Call V_ExtradataRefresh(1, 'Computers');