Win 81. and built-in admin account

Banzai_Joe · 21 Jan 2015 at 12:12

Hi all,
I'm logged into a win8.1 machine as domain\administrator, so not strictly speaking the 'built-in admin account', yet i cannot access internet explorer.
This is nuckin futs. I need access to IE to do certain admin tasks. Not to mention our DMS is on our intranet.

Anyone know how to get round this please?
I admint i've not done much googling on it, as i'm busy doing other stuff and hope that i'll get an email telling me that some kind soul has replied with a positive answer

Thanks

Banzai_Joe · 21 Jan 2015 at 12:14

Ok, weird.
If i go run > "iexplore" then it opens up IE, but the metro version can't be used. That's really dumb.

m4cc45 · 21 Jan 2015 at 12:58

Probably also quite dumb to use a domain admin as a user account really. Make a separate account asap would be my advice.

M.

Banzai_Joe · 21 Jan 2015 at 14:02

m4cc45 said:
Probably also quite dumb to use a domain admin as a user account really. Make a separate account asap would be my advice.

M.

Say what?!?!?!

Domain admin isn't a 'user' account, its a domain admin account. The account that any admin would use to install and configure software on a domain computer.
:rolleyes:

K.C. Leblanc · 21 Jan 2015 at 17:30

Banzai_Joe said:
The account that any admin would use to install and configure software on a domain computer.

No really it isn't!! It's something you would use for admin tasks on your servers.

You need an account that has local admins rights to your workstations and access to the network areas you need for deployment etc.

Bry · 21 Jan 2015 at 17:36

Banzai_Joe said:
Say what?!?!?!

Domain admin isn't a 'user' account, its a domain admin account. The account that any admin would use to install and configure software on a domain computer.

Its really not, infact any web browsing via a domain admin account is one of the worst things you can possibly do. My boss would fire me if I was caught doing that!

Any virus could affect your whole domain - potentially thousands of computers

KIA · 21 Jan 2015 at 19:40

m4cc45 said:
Probably also quite dumb to use a domain admin as a user account really. Make a separate account asap would be my advice.

Quoted for truth. Never use an account with full privileges if it can be avoided.

Banzai_Joe · 22 Jan 2015 at 08:38

Thanks for the replies fellas.
Having being doing my job for over 9 years (without a great deal of mentoring) i've used 3 different I.T. companies for support and none of them have ever suggested what you seem to be saying.
I'll query it with them.

Banzai_Joe · 22 Jan 2015 at 08:40

back to my main question though, why would win8.1 think that the domain admin account is the 'built-in' account? Surely that would be win8.1pc\Administrator not domain\administrator

KIA · 22 Jan 2015 at 13:15

Banzai_Joe said:
Thanks for the replies fellas.
Having being doing my job for over 9 years (without a great deal of mentoring) i've used 3 different I.T. companies for support and none of them have ever suggested what you seem to be saying.
I'll query it with them.

This is a good read.

http://www.sans.org/reading-room/whitepapers/testing/pass-the-hash-attacks-tools-mitigation-33283

You're better protected if you have Windows 8.1 and Server 2012 R2.

ChrisD. · 22 Jan 2015 at 14:24

Banzai_Joe said:
Thanks for the replies fellas.
Having being doing my job for over 9 years (without a great deal of mentoring) i've used 3 different I.T. companies for support and none of them have ever suggested what you seem to be saying.
I'll query it with them.

Use different companies.

m4cc45 · 22 Jan 2015 at 21:39

Banzai_Joe said:
Thanks for the replies fellas.
Having being doing my job for over 9 years (without a great deal of mentoring) i've used 3 different I.T. companies for support and none of them have ever suggested what you seem to be saying.
I'll query it with them.

I've been involved in IT for 15+ years - not that longevity means anything. The reasons why you wouldn't use a Domain Admin are too numerous to list and have been pointed out by the people above. Seriously make your self a member of the local admins by all means but don't use a domain admin for administrating a PC - it's not what the accounts designed for make sure you have a separate account for that.

I assume you're typing in .\administrator as a logon name and I also assume you've enabled and the account and set a password?

M.