Domain User Accounts Best Practice

Check out this on demand webinar on best practices for managing domain admin accounts to learn pro tips to protect your organization from critical attacks.

Domain user accounts best practice. In addition to the username and password properties domain user accounts include additional properties such as office location office phone number and e mail address. Here are a few ad user management best practices to. Using a separate account for admin tasks. The best practice for a windows domain is to have no local workstation users or membership of local groups at all.

Members of the da group are to powerful. Each technician of appropriate responsibility has two domain user accounts one regular user that they use to login to their own computer and do most of their day to day tasks with and another account that has domain admin permissions which they use to open the tools and perform the tasks that require this. Local accounts have no connection with any domain which may exist on the same network. With thousands of user accounts to manage it s easy to get overwhelmed.

There should be no day to day user accounts in the domain admins group the only exception is the default domain administrator account. The risks of using privileged domain accounts on devices that are not secured to the same level as dcs increases the chances that domain administrator credentials could be exposed. The addition of users to the local administrators group. If you can take steps to ensure a healthy active directory your chances of a security breach drop significantly.

Presumably the customer is using the microsoft domain model of networking for a reason. In a case like this i would setup a local admin account for each user that doesn t have domain access. Local accounts have no connection with any domain which may exist on the same network. They have local admin rights on every domain joined system workstation servers laptops etc.

The best way to avoid headaches is to be proactive. It s been my observation that in most organizations administrators use their normal user account for admin tasks. Active directory best practices for user accounts. The best practice for a windows domain is to have no local workstation users or membership of local groups at all.

The account is made a member or domain admins dns admins exchange admins or whatever admin group grants the appropriate level of permissions for their role.