Best security practice is that only people who should have access to a sensitive password do have access to a sensitive password. While this is certainly better than the same password being used everywhere, it means that whoever has the password to the password protected Excel file has access to all the secret account passwords.

The password for managing one router should be different from the password used to manage another router, just as the password for the SQL Server service account should be different form the password that has permission to extend the Active Directory schema.Įven when passwords are different, some organizations use a password protected Excel file to keep track of complex account passwords.

While administrators may need to share passwords for privileged accounts, they need to do it selectively. The clear and obvious problem with this scheme is that if you know the super secret password for one task, you know them for all tasks. Want to change the router setting? Use the super secret password! Want to recover private certificates from the certificate services database? Use the super secret password! Want to extend the Active Directory Schema? Super secret password. Some organizations have so much trouble with keeping track of these special passwords that they use a single shared complex password for all administrative things. – It is necessary to keep track of specially privileged administrative accounts. – You want to keep track of directory service restore mode passwords

– You need to keep track of administrative passwords for networking devices and non-domain joined computers – It is necessary to keep track of service account passwords (assuming that the organization isn’t using operating systems that support managed service accounts) Installing and Running Pleasant Password Server.Managing Privileged Account Passwords with Pleasant Password Server.

Keepass active directory