SEVA: Local Administrator Password Management

Pass-the-Hash (PtH) attacks against the Windows operating systems are becoming common. Microsoft wants organizations to assume that a breach has already occurred in order to highlight the need for a more mature defense. In most organizations, the Local Administrator Password is shared amongst many administrators and is a small set of static strings. This raises major security concerns specially when it comes to Pass-the-Hash attacks.

With Synergix Secrets Vault ( Seva ) installed, Local Administrator Password is system generated and stored in a key vault in encrypted form. Passwords are validated regularly and reset to maintain the integrity. The password vault is infallible to the extend of Azure Resources. Only designated administrators, explicitly excluding Global Administrators, are allowed to retrieve and decrypt the password strings.

 

Seva supports Windows 7.0 SP1 to Windows Server 2019 computers, that are Azure AD joined, On Premises AD joined, Workgroup joined or in any other hosted environments, including Amazon, Google, etc.
Encryption

Administrator Password is encrypted using unique encryption key

No Schema Changes

No Schema Changes are required as passwords are stored in the vault.

Remote Desktop

Remote Desktop connection can be established without typing username or password

Least Privileges

Workflow is built following the principle of least privileges

Auditing

Integrated Audit Logs

Unique Password

Local Administrator Password is unique and varies in length from 16 to 48 characters

Delegation

Leverages delegation in Azure AD to manage access to the vault

Business Justification

Requestor is required to type business justification before opening the password valut

Password Masking

By default, password is masked, when first retrieved.

Instrumentation

Computer properties, from various WMI claases, are stored in a database./p>