[abel]

The network administrator is leaving our company. I have to change the administrator's password in order to take away his privileges. He has set up an additional password that affects all other NT workstations and servers he calls it the wslogin password. Says that when I change that password all servers and workstations have to be restarted. Is this true? Why would I need to change the wslogin password?

[Reuel Miller]

Greetings

I have never heard of a wslogin. It may be that he is just trying to pull the wool over your eyes.

Or, it may be his backdoor into every NT machine on the network. It maybe, that he has put a password on the LOCAL administrators account, and it is the same password that he uses for the domain admin's account. He might be using this backdoor to Backup everybody's drive.

The way to get around this, is to make the Domain admin's account part of the Local Admin's group on each machine (this is normally automatically done when an NT machine is added to the domain). That way, you can change the password on the account and still have access to the workstations.

If you do not have a domain (ie. the Servers are all stand-alone servers), then it might be that he logs into the Server with the server's Local Admin account, and this is the same password that he uses for all machines. What you would have to do then, is change the Local Admin's password on all machines. It is not necessary to reboot them, unless they have to be logged in with the Admin account, and then it is only necessary to log off and log back on again.

Hope this helps

------------------
Reuel Miller
Windows NT Moderator (yes, that does make me biased )

rmiller@xperts.co.za

Every morning is the dawn of a new error...



[This message has been edited by Reuel Miller (edited 12-11-1999).]

[Reuel Miller]

Greetings

Abel emailed me while the server was down. Here is the mail, plus my answer:

Greetings

> Thanks for replying to my posting. Tried posting a reply to your
> reply but
> received a message that the bulletin board is temporarily out of order.

Yeah... the helponthe.net server got an upgrade over the weekend :-)

>
> The wslogin is an account he created with administrative privileges. He
> uses this account when setting up a workstation. When he is
> asked to enter
> a username and password of someone with the ability to add workstations to
> the specified domain he types wslogin as the User Name with the respective
> password. Says he created this account so that when others (our technical
> help person/s) build a workstation they are able to use this account
> (wslogin) to connect the station to the network without using the
> administrator's account.

Ok.... then all this account is used for is to add NT svr and NT wks machines to the domain. By that definition, it is a domain admin account, with full domain admin rights.


> Now, since all servers (seven of them) and workstations used this account
> (wslogin) and password to connect to the domain, when we change
> the password
> they will lose services. If this is the case, we at the department (more
> likely me) will have to reconnect all servers and stations that used this
> account. Is this true? It seems to me that there is a better way to do
> things.

No, changing the password on the account will not make the servers lose their connections. The servers (and Workstations) only needed that account instantaneously, at the moment of joining the domain. Now that the computer has a computer account on the domain, it does not need to use that account any more. It just needed it at that instant, to verify that a domain admin wanted to add the computer to the domain.

Change the password at will.

PS. best length for an NT password is 7 characters (for an in-depth treatise, go HERE), with numbers, capitals and other extended characters. e.g S@ndl2r an old password of mine.

It may look like gobble-de-gook to you, but it means something very easy for me to remember:

1) I take a concept I dislike: In this case, the surname of Adam Sandler
2) I misspell it: Sandlar
3) I substitute an "@" for an "A" : S@ndlar
4) I substitute a 2 (which is an "@", but without the shift key depressed): S@ndl2r

Now, all I have to remember is the Keystroke pattern:
Holding down the shift: S@
Release the shift: ndl2r

I normally hold down the shift with my pinky, surrupticiously. That way, if anyone is watching me, they will miss that and get my password wrong. When I was very paranoid, I used to hold down the ALT key and type in parts of my password using really extended ASCII characters... but now I have my medication

See... an easy to remember password that took L0pht crack 7 days and 18 hours to crack on a Pentium2 200, with 96 megs of memory (it was the only password it had to crack). Now, I am not saying use this exact method, instead find a method that makes you comfortable and stick with it. Always keep the method the same, that way you get wayout passwords, that are easy for you to remember, and are a Groff to crack.

Cheers

------------------
Reuel Miller
Windows NT Moderator (yes, that does make me biased )

rmiller@xperts.co.za

Every morning is the dawn of a new error...



[This message has been edited by Reuel Miller (edited 12-13-1999).]