Don't Let Your Domain Admins or Enterprise Admins Password Get Hacked

As an administrator, you've probably physically secured your DCs to prevent hackers from cracking Active Directory (AD) password hashes. It's equally important to physically secure the workstations, laptops, and member servers on which you might use Domain Admins or Enterprise Admins credentials. Even if you use a laptop or workstation to connect to a DC through RDP, your password is saved in the local cache by default, so you need to physically secure that computer.

You should turn off domain credential caching in the workstations, laptops, or member servers on which you might use Domain Admins or Enterprise Admins credentials. To do so, open the Group Policy Object Editor and navigate to Computer ConfigurationWindows Settings Security SettingsLocal PolicesSecurity Options. Look for the Interactive Logon: Number of previous logons to cache (in case domain controller is not available) policy. By default, the policy is set to 10 logons. As Figure 1 shows, change the setting to 0 logons to disable the local caching of logon information. If you don't want to turn off cached credentials on member servers because you want to be able to log on when a DC isn't available, you should set a local Administrator password on each server. Each password should be different. If you forget a local Administrator password, searching five minutes on the Internet will give you several options on how you can reset the password.