[PAM] Need to enable user account and forbid password change?

[PAM] Need to enable user account and forbid password change?

avatar
Rulixs

I'd like to import Windows admin accounts under the server (non-domain) into the PAM.
Let us assume we have 2 admin accounts and one standard account.

  • Admin01 (initial administrator from windows installation)
  • Admin02 (Addtional administrator)
  • User01


When PAM quick import is run, I am instructed that only "enabled" and "password-locked" accounts can be imported.
However, windows does not allow the situaltion where all admins are password-locked. Thus, I cannot import two Admins into the PAM.

What is the best practice here? Do I need to leave at least one admin account out of the PAM protection?

All Comments (2)

avatar
François Dubois

Hello,

Thank you for reaching us about that. We probably missed those restrictions with Windows accounts. I understand your concerns. I will talk internally with colleagues and see how we could solve that and let you know when we have a solution.

Best regards,

François Dubois

avatar
Erica Poirier

Hello,

There is a workaround for the additional administrator accounts to be imported and managed it in the PAM. But for the builtin administrator account, as my colleague mentioned, they will discuss about it.

For an additional administrator account, here are the steps :

  1. Create the account as a standard account.
  2. Enable the User cannot change password option.
  3. Save the account.
  4. Edit the account.
  5. Add it in the Administrators local group.


With this method, you should be able to manage this account into the PAM. And if you need more than one administrator account, then you could disable the builtin administrator account and create as many local administrator accounts as required and manage them in the PAM.

Let us know if that helps.

Best regards,

Érica Poirier