increase your machines security with a unique local-administrator password

Set up Active Directory so that users who were locked outside their Windows machine and are off-site can nevertheless get access to their local machine in a secure, effective manner

In a nutshell:

1. Extend the A/D Schema
• For computer objects, add a localAdminPwd field
• Set an ACL on this field: only accesible to Domain Admins and your helpdesk team
2. Configure Group Policy
• local administrator: denied log on from the network
3. Set random password for each local administrator
• Use a script to generate a random password
• store password in A/D
• set the password on the machine's administrator account
• if you fail, role back so the two are always in sync
4. Add scripts to the Active Directory Users and Computers administrative tool
• "Get local admin password" - will show helpdesk members the current password for a given computer account
• "Set local admin password" - will generate a random password and set it on the machine and in A/D (or roll back)
5. (optional) Enable Paranoid mode
• Add a 2nd field in A/D: pwdLastChanged
• Use a scheduled task to change the local administrator password every so often in A/D and on the local machine

In action:

Suppose your CFO is on a business trip. Unfortunately, she forgot her Windows password. She is scheduled to give a keynote to a major client in 10 minutes (yeah well, I changed my password 3 days ago, can't remember it now. I didn't write it down, as you recommended but now I'm stuck!)

Problem? No Problem

• Locate the computer in A/D. Right click and select "Get Local Admin Password". (remember, must be an admin or helpdesk to do that)
• spell it out to your CFO (or SMS ?)
• She can now log in. Catastrophe averted.
• If you have time, have her start the VPN dialer and reset her A/D account's password, let her log in. no time? let's just use the local administrator account for now.

Where do we go from here ?

We've been using this for a few months now, it really works.
In fact we also plan a self-help service which will send the admin password by SMS to registered phone numbers.

So... what do you think? where have we gone terribly wrong ?!
I hope to share the sources and a bit more details soon.