Protection against Domain Administrators
Hello,
We are service provider and all employee have technical skills and have access to the domain administrator credentials to maintain our own infrastructure.
We need organize passwords with different security permissions, because some employee have more security clearance for customer passwords than others.
We also need to host RDM Database on-premises for privacy policy reason.
As far as i have found out, all server administrators can access RDM database with Administrative permission.
I can encrypt the Database and protect it with passphrase or certificate but i need to share this information with all employee.
I can set up a devolutions server to only share the secret with the server, but domain administrators will have access to devolutions server.
I can set up a standalone windows server without domain integration, but backup administrators can access all information in backup files.
The only solution i have found is to setup a devolution server on a standalone windows host with bitlocker encryption enabled so no one can access the database thru backdoor or take them with him.
Is there a simpler solution?
Regards,
Thomas
All Comments (3)
Hello Thomas,
Thanks for contacting us for your security needs.
Normally a server administrator is not DBO on your SQL server. Multiple option is available for you:
Please let me know if this option is good for you.
Best regards,
David Grandolfo
Hello,
if you have physical access to the server, (and all employees have physical access) you can do the following:
- Login in to the Windows Server where Devolutions Server is installed with Credentials of the user who set up Devolutions server
- Open Remote Desktop Manager with configured Data Source for Devolutions Server
Now you have access to all Passwords with Administrator Permission and you can make a private copy.
If you don't know the password of the user who set up Devolutions server - Reset it. Domain Administrators can do that.
Regards
Hello Thomas,
Sorry for the delay, I didn't see your answer.
The database doesn't have to be configured in RDM or if you configured it for a specific reason, just check Always Ask username and Always Ask Password. So with this, the user doesn't have the access to the database. Also the user with whom you are login in, should not have administrator right to the database.
Best regards,
David Grandolfo
Ask_Credentials.png