Thwart Hackers with a Dummy Domain Administrator Account

When you set up an Active Directory (AD) domain, it automatically creates an Administrator account for that domain. Because the domain Administrator account is responsible for controlling all the objects in the domain, it's a common target for malicious activity. You can tighten your domain's security by changing the name of this account and putting a dummy account in its place. This is simple to do:

Once the dummy account is being audited, you should periodically check the event logs for failed security events. The events will most likely be due to

No matter whether a failed security event is due to a malicious attack or an incorrectly configured application, you have a problem.

Note that every member server and client has a local Administrator account, so setting up a dummy domain Administrator account won't protect the member servers or clients. However, you can set up dummy accounts for local Administrator accounts as well.