|
The network guys have mandated that all service accounts must have their passwords renewed every 60 days. This means we have to wait for the passwords to be changed, and then be told what they are so that we can turn off all of our apps/services, make the changes, and turn everything back on again. We have over two dozen service accounts that our group owns.
Every.Sixty.Days.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
|
John Simmons / outlaw programmer wrote: We have over two dozen service accounts that our group owns.
Time to consolidate?
Message Signature
(Click to edit ->)
|
|
|
|
|
And they have to follow the STIG rules too right? Is it can't reuse in the past 12 or 24?
|
|
|
|
|
Right.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
|
I would like to take into account to write a small app (or use powershell) for this 
It does not solve my Problem, but it answers my question
modified 19-Jan-21 21:04pm.
|
|
|
|
|
You're assuming that the DoD would let us use such a script. You'd be wrong.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
|
|
That's a remarkable cogent analysis for a UK Government department: are you sure it's not a fake?
Sent from my Amstrad PC 1640
Never throw anything away, Griff
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
Given that it's not only their job but their fervent desire to spy on as many non-criminals as they can, I'd posit that they're only saying it because it's completely untrue -- it's easier for them to crack our passwords if we don't change them regularly
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
Sounds familiar. On the first business day of every month, I change my password. It's a good idea to be proactive, because if you let it expire (45 days), you can be locked out of your account and will need to get someone else to unlock it for you. When I change my password, I also have to change it for the scheduled tasks and services(*) on our three build servers. The process takes about 10 minutes, and I re-enter the new password 6-8 times on each machine.
Back when we used Bloatus Goatse the process was even longer, and you had to re-enter the old password a couple of times before you could change it.
(*) Supposedly we have "robot" accounts whose passwords never expire. I tried getting one, but there was no way to set the password for it. It granted employee-level access if it was used.
Software Zen: delete this;
|
|
|
|
|
If the service accounts are being used for windows services (rather than linux services), you can transition to Managed Service Accounts. They're fantastic, and I've been advocating their use in our environment for a couple years now. Never change a password again and be STIG compliant. Just don't confuse basic MSA's with Group MSAs (there's a lot of reference material for GMSAs out there that just call them MSAs); the latter are not okay for STIG purposes AFAIK.
Managed Service Accounts: Understanding, Implementing, Best Practices, and Troubleshooting | Ask the Directory Services Team
They're a little more complicated to work with than traditional user accounts, but not much. If you're interested I have a couple scripts built to help stand them up and work with them, or I can talk you through them. I'm in the GAL.
"Never attribute to malice that which can be explained by stupidity."
- Hanlon's Razor
|
|
|
|
|
I wonder if that's what my former DoD contractor used, or if they rolled their own?
All I know for sure is that after extended pushback from my boss and a coworker who was tired of his user account (which was running our CI server processes) getting locked out after every password change when the running service quickly maxed his fail total out. After initially trying to claim there wasn't anything they could do to help us (a common occurrence before management started swinging a heavy cluebat at them) they set up some sort of highly locked down account with no permissions beyond the minimum needed to run the Cruise Control builds and status server that they maintained automatically for us either with a permanent PW or by automating PW rollover on their side.
Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason?
Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful?
--Zachris Topelius
Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies.
-- Sarah Hoyt
|
|
|
|
|
It's possible. MSAs have been around since Windows 2008, and are only just starting to gain traction in the enterprise environment. They're great because they are non-interactive and locked to a specific computer, so if an action is not sourced from that specific host it will fail authentication.
"Never attribute to malice that which can be explained by stupidity."
- Hanlon's Razor
|
|
|
|
|
You may tell him about user accounts that made specially for services?
"The greatest enemy of knowledge is not ignorance, it is the illusion of knowledge". Stephen Hawking, 1942- 2018
|
|
|
|
|
That should be just for the ones with "elevated" privileges.
Can't wait until Novemeber so I'll be done with this...nonsense.
|
|
|
|
|
To get a scrollbar in a TextBox control, you have to MANUALLY set the height/width of the control (along with all the other properties that need to be set for using scrollbars).
WHY, in this nTH iteration of WPF, do we still have to do this? WHY can't WPF be smart enough to infer the height/width from the parent control when you specify a horizontal/vertical alignment of "Stretch" as opposed to specifically defining a height/width? WTF Microslop?
BTW, it's great to be working as a developer again. 
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
|
|
WPF sucks only because you don't have a deep enough knowledge of the dammed thing. That Stretch/Auto combination Richard mentioned always stumps me until I can remember the last project where it was needed (or I search for "Richard" as I always include a link back to CP where C&P has been used).
I read everything that goes through the WPF/Silverlight forum. Between the Richards and POH there are some really useful titbits to be picked up.
Never underestimate the power of human stupidity -
RAH
I'm old. I know stuff - JSOP
|
|
|
|
|
I love WPF! And all the other XAML variants!
That said, the best critics I have seen throw at WPF is "easy hard, hard easy", i.e it's easy to do hard thing, but hard to do easy things!
Haha there is some truth to it! 
|
|
|
|
|
Is Santa North Polish?
Sent from my Amstrad PC 1640
Never throw anything away, Griff
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
No he is bipolar 
"If we don't change direction, we'll end up where we're going"
|
|
|
|
|
If he has sharp fingernails, are they Santa Claws?
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
I thought South polish, otherwise wouldn't he be repelled from his home?
Message Signature
(Click to edit ->)
|
|
|
|
|
But he IS repelled! I just saw him at the local department store.
"If we don't change direction, we'll end up where we're going"
|
|
|
|
|
Wouldn't that make him a Balt[^]?
Freedom is the freedom to say that two plus two make four. If that is granted, all else follows.
-- 6079 Smith W.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
