Home / server / Questions / 390453
Accepted
Mohnish
Asked: 2012-05-19 08:01:46 +0800 CST

Windows 7 - Network admin access to user login credentials?

  • 772

In a Windows environment, does the network administrator have access to the user network password? Can he use the user LAN credentials to login to his machine when the user is away?

EDIT - I ask this because my company has implemented SSO to ADP payroll website. If I'm logged in to Windows, I'm automatically logged in to our intranet site. And if I click on ADP link on my intranet site, it automatically (SSO) logs me into ADP portal.

Given this, my network admin can see my personal info, if he has access to my LAN network user/pass. I understand that admin can reset pass etc. but does he have access to real user password on LAN?

windows networking

6 Answers

  1. Best Answer

    No. The domain administrator does not have access to any other users password and can't logon to the domain as that user, unless the user has given the domain administrator their password.

    • 3

  2. A domain admin could enable that passwords are stored with reversible encryption, in which case they could technically access your password. The only places I've seen this done were ones that had old RADIUS products that required AD integration. Any decent SSO product should not require this setting. That said, it's remotely possible, but very unlikely.

    • 2

  3. You can always change any user's password in AD. And I believe if you login to any PC using different credentials it'll kick the other user out. What are you trying to accomplish?

    • 1

  4. They only way the network admin should have the user's login credentials is if the user told the admin what they are. If he is a domain administrator then he can log the user out using his credentials though.

    • 1

  5. In addition to what you have just added within your edit, the network administrator can only have password if he has access to the domain controller and can install his/her own software to brute-force the passwords (very easily if the password is weak). In normal circumstances your answer would be no, he/she does not have your password.

    • 1

  6. My view on this is that the bigger risk is colleagues when a user walks away from their desk and leaves their screen unlocked. Open access to Windows, data, email and any system with SSO.

    While typcial Windows passwords are protected in a way they cannot be reversed (given time and resource maybe) it is possible that an extremely bad decision has been made to change this default config. http://technet.microsoft.com/en-us/library/cc784581(v=ws.10).aspx

    • 0