Automate DSRM Password Update

DSRM Password:

Managing DSRM Password is one of Key aspects in every AD Administrators, whether it’s to perform an authoritative restore or fix database issues, will need the local administrator password.

Typically, we don’t use DSRM password when dc running normal state, and the DSRM credentials are not like our regular credentials to use them daily usage, hence forgetting the password is quiet expected behavior.

The DSRM Password has been set during domain controller promotion, hence maintaining the password consistency is one of the other challenges.

Solution:

Microsoft had introduced one of the new features starting form windows server 2008, the DSRM Password can be synchronize your Active Directory Domain Account.

Key Feature:

Ø  DSRM Password can be change regular basis.

Ø  The process is including exiting Domain Controller and New Upcoming Domain Controllers.

Let’s jump into the LAB and see how it works:

> Create Standard Domain Account with following values.

> Account Disabled State for security reason.

> Password Never Expires Should be enable.

> The account does not need to be part of any privilege group.

> To Synchronize DSRMSync Account password into domain controller, run the following command.

 Ntdsutil "set dsrm password" "sync from domain account DSRMsync" q q

> The Account successfully Synced to DSRM, to validate the password I am going to reboot the DC with DSRM mode.

> Login the domain controller with password of DSRMSync Credentials. 

> We successfully passed DSRM Console with AD Account.

   > DSRM process does not recognize AD Account password changes, hence we need to synchronize the password every password update.

      > Updating the password 100 plus domain controllers always not possible through manual, Hence, we perform this activity through GPO. Consider we are resetting our DSRMSync password every quarter during SOX etc. we will schedule to update our AD Password every 3 months once.

  >To Enable this feature, we would require one Service Account with “Domain Admin” Privileges. 

     

     > Open GPMC and create NEW GPO / Use Existing GPO on Domain Controller OU to enable this feature.

     > Create Schedule task under Computer Configuration

> Action Tab

> Wait for the GPO update, verify the DC task scheduler.

> Reset the Password of DSRMSync and Run Schedule task to manually check the sync process.

Password changed suceessfull.

A user account was changed.

Subject:

              Security ID:                         TEST\Administrator

              Account Name:                   Administrator

              Account Domain:                TEST

              Logon ID:                           0x457E8

Target Account:

              Security ID:                         TEST\DSRMsync

              Account Name:                   DSRMsync

              Account Domain:                TEST

> Run Sync manually

> WOW it got synced!

                                      *****Happy Learning*****