|
Yes, the administrator could reset the user's password. I know of no way to take out-of-the-box AD and make it remove this privilege for the administrator. (There may be some deep and dirty AD config in the ACLS, however, but an admin could change them back.) However, if the administrator does not know the user's password, and uses the reset function, he cannot reset the password back to what the user used. So the user, when she tries to log on next, will not be able to, and will have to contact the help desk to have her password reset. This activity, of course, should be investigated. Yes, users do forget their passwords; but, couple this with a strong audit policy in the event log, and event 627 "A user's password was changed" will be recorded. You can match these with user requests. In addition, you can set up EFS so that an administrator would have to access the files from the user's workstation in order to decrypt them.
When the reset password privilege is delegated to a help desk, even more interesting issues abound. We tend to hire and vet administrators and expect a little more of them, and pay them well. We believe they know the rules, and we watch these privileged persons a little more closely. Help desk personnel are often not paid well, have less education and turnover is rampant. Even if you solve all those issues for the help desk person in your case, you still should work on getting some monitoring (see the audit route above).
And, yes, your solution might work. You could script removal from a group after password reset. You could also make that a requirement, write a password reset script that first removes the user from a group, then resets the password. The help desk uses this instead of Active Directory Users and Computers.
I like the concept, too. It separates duties; that is, the help desk can reset a password if they remove a user from group. Finance can put a user in group. Neither can do both. There would have to be collaboration for a malicious act.
Still, a rogue admin or a help desk person (if the privileges aren't worked out correctly) can access the normal password reset functionality in Active Directory Users and Computers. A number of things can go wrong. Ideally, if files are that sensitive and the risk cannot be tolerated, you need to adapt some other method of authentication like a smart card or biometrics. With Windows 2000, certificate services come free. You would have to purchase the cards and/or readers, but the software is there. You would have to securely implement them; and, no -- once done, you do not have to make every user use a smart card, you can just use it for the finance group and you can require that the smart card, not the password, is used. If a smart card is lost or damaged, a new one can be issued. This can be done in a way in which only the user sees the PIN. Even if the card is lost, it cannot be used without the PIN. After a small number of PIN "guesses," the card self-destructs.
Let me know what you do, and how it works for you. Developing sound and secure business practices from mounds of technical information is not always easy.
|
