IT Employment

Ask something
Discussion Locked

AWOL Net Admin!!! Need Help ASAP

0 helpful
27 replies

by evinjhill

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi everyone,
I need some help, whether it to say I'm screwed or if there is a fix. I just was hired to replace the IT manager, but he did not show up to "show me the ropes". The CEO nor the COO have any logins/passwords to any of the servers. The old IT manager kept all the passwords to himself. I found a master PW list, but they do not work. If the passwords were changed by the old employee how can I or the company reset the administrator passwords? Or are we SOL? Thanks for any help!

27 replies

by oz_media

Your IT Mangager is 100% responsible fo rsharing that information with you, failure to do so can result in positive legal action. This is your employers concern, not yours.

I woudln't take to hacking your network if I were you, just tell the boss that the guy left wih all the secure login information that belongs to your company, it is illegal.

by jkaras

Lets say that you and your employer get into it and you quit because you/he obviously crossed the line with each other. In a huff you give the passwords and the finger to "the man". Now he gets mad and decides to get even to show you who is in charge. He claims that you never gave any such passwords to get back at him and seeks legal action, your word against his, then what? Or what if this person is the fired individual wanting tricks to hack his old network? I am not trying to be a jerk or anything but this is a possibility of what could happen. Other than protecting yourself with documentation/redundancy other minor admin how would you protect your reputation? With out any witness to the exchange who is trusted as to the truth? Even if someone witnesses you handing a letter with the passwords, the witness doesnt see the actual contents or seen executed that they work and the manager claims that the information on it was wrong? This is just a hypothetical mind you. I am sure some things like this eventually happen to some people, but not on a frequent basis.

by unclerob

It's not your job to hack into your network on your 1st day. Especially if you're the IT manager, plus if you're the manager I'm assuming you have a systems admin or two that can help you with this problem. Otherwise lose the IT manager handle and just call yourself a PC LAN Technician (I can almost hear the frantic shouting in your original post, "Oh No, what do I do?")

Speak to your boss & HR and have them contact the previous IT mgr, they can formally request this info which should have been left with mgmt before he left. Mgmt is usually pretty slack on this issue as I've seen this happen before not just where I work but in other places too. It shouldn't be a problem for the previous mgr to give this info. Once he provides it and you have access to the systems again, change all the required passwords (something we do where I work whenever a system admin leaves the company).

If they can't get this info from him willingly then they can pursue some form of legal action against him at which point you'll be forced to use some 3rd party vendor tool like Winternal's ERD tool suite or resort to some linux bootdisks which allow you to reset admin passwords and what not (I'm not advocating hacking just saying that there are resources available if the situation calls for it) - this isn't an impossible situation.

If the systems are still running and no one's complaining about system issues (ie. user's can't print, IM or email's down, can't access network shares on the file server, internet access is down, etc.) then don't fly off the handle, you seem to be running around like a chicken with it's head cut off.

Don't sweat it if you just stepped into this shop and don't have the info provided to you, it can hardly be viewed as your fault or you inability to fix a problem. Just act like a manager and manage the situation professionally.

Just my 0.02 cents cdn, feel free to agree/disagree.

by ippirate

I've seen this type of situation go both ways before.

Although there is some grounds on an ethical front, if the employer was not intelligent enough to request/demand the information prior to the IT Manager leaving, it may not be so easy, especially if it is an "At Will" state. To my understanding and experience there would be three key questions.

One, is the state an "At Will" state, in other words, is employment subject to the wind or is employee notice/employer justification necessary?

Or....

Two, did the employer ever make a formal request of the information in question?

Or....

Three, did the employee submit a two-weeks notice and then fail to fulfill that two weeks?

Any of the three above could provide an avenue of litigation. The only other direction that I am aware of that might be of leverage would be state ethics or intellectual property laws. Depending on the state again though.

Just my two cents...

by oz_media

The employer would have to contact the former admin and request the information. If it is refused or said to be forgotten, he is either witholding proprietary information and jeopardizing security, he may also be hit for negligence.

Corporate law is pretty friggin' dirty stuff, definitely makes most lawyers seem friendly.

by evinjhill

Guys, thanks for the replys. I guess what happened was the information was not passed down the chain of command. The other IT manager who was out of town, was not informed that I would be starting on that Monday. The Director did know, but did not pass the info to the upper management outside of IT that the other IT Man. would be out. Everything got squared away, it just was a cause for concern if it had been a "disgruntled" employee who left without leaving the passwords. Is there a solution or a policy that should be implemented from either side? I know some IT people hate giving up the info to the upper management, but who should the policy come from? The Management or the IT Department?

by Member 19345100

If you are running Linux, then you can break into the system easily enough if you have physical access to the console. Just boot into single user mode, then change /etc/passwd and/or /etc/shadow so you have a root account, then finish booting. If you are running NIS you will have to change the NIS passwd map, but you can do that.

If you are running Windows, then you may have a problem. I seem to recall that you could create a new domain controller (BDC) with a known administrator password, then down the existing PDC and promote the BDC to PDC and gain control that way, but I forget the details.

But I agree with the first poster - this calls for legal action.

In general, I give the list of master passwords to the boss in an envelope sealed with wax and marked "not to be opened". I explain to the boss that he is not the sysadmin, I am. He is the boss. He doesn't do system administration, he hires system administrators and they do the system administration. They will need the contents of that envelope and it is his job to deliver the envelope, not to open it.

by oz_media

Hacking 101 :D

In this case the poster may be very legitimate, but we don't REALLY know for sure who is and who isn't.

I prefer to leave things like that for people to take care of without my help, if you know what I mean.

;)

by jmgarvin

I'd like to talk about security from a different stand point.

How would you know that you aren't getting the baddies in there...I don't know. Maybe double check everybody that wants to join or at least have some disclaimer ;-)

by jmgarvin

What you suggest probably won't work.

However, I would just get the guy through legal action. The bad seeds give all IT people a bad name and make us ALL look bad.

Nail him to the wall with legal action.

by dr dij

A friend was consulting for a school district where the sys admin had gotten 'too stressed out', skipped work without notice etc. She was finally terminated but never handed over unix server passwords. They never recovered them, had to reformat the server.

Would the linux method have worked with unix?

by gerry a

I cant think of a thing you could do other than call his house and his cell phone (use two phones if you have to) until he answers! Check your company policy regarding information and data theft (because that is what this is) and see if you can get the cops involved. That might work too.

by hastain

This has happened to me as a consultant several times. Here is the straight dope from experience.

You probably need those passwords immediatly to maintain your systems. There are technical fixes but before you take those:
-document all the servers that you do not have access to i.e. server name, application of server, admin group members (if you can) etc. the more documentation thoe more apt you are to follow up on legal recourse.
-if you "hack" the passwords document the tools used and time and date and USE A WITNESS i recommend some thrid party just to watch over your shoulder. if this thing goes to court this will be very important.
-get your new boss to sign off on his approval for you to hack the passwords. get it in writing and every gets a copy

now to hack passwords
of course depends on server
Windows NT/2000/2003
#1 easiest way is go here and use tool
http://home.eunet.no/~pnordahl/ntpasswd/

there are other methods but this one has proven 100% reliable. it basically is a linux boot disk that resets the admin password. there are tools you can buy that do the same thing, ERD commander for example, but this tool is free

if you have linux boxes it depends on the flavor of *nix. google it and there are a number of tools.

As for providing information to would haX0r5, well google is free and these hacks are pretty much out there for anyone who can use a search engine.

hope this helps

by synthetic

Couldn't agree more, document, document document. Your opening yourself to liability, sad state of the time, if your boss is unwilling to sign off, and but his/her butt on the line, why would you?
and the above mentioned tool, works like a charm, I have used it for years, and it is great, even if you don;t use it now, you will want this utility in your stable. Much better, and easier to use than ERD 2000. Good luck!

by roger99a

Got a job in a place where nobody knew the router passwords. Fortunately they lasted until the upgrade and we got control again.

I can't believe that a company would only have one person with admin rights. That's just not redundant. If the bosses can't or won't get that information for you call your vendors. Microsoft will help you for a fee. If you have supported software those vendors probably have some access and may can help.

by jmgarvin

Sometimes when people leave it doesn't matter if everybody knows the admin password. The person that has been fired/replaced/ect changes the password and takes off, never to be seen again.

People like this need to be charged to the fullest exent of the law. Not only do they cause a loss in productivity, but they are also potential threats to the organization.

by singerguy

I had to smile when I read this. I am the only IT person in my company. I have two clerical people who can help out with locked user accounts, setting up Outlook for a new user, and other basic help desk functions, but I'm basically it for the "hard stuff." They both know the admin password in case I step in front of a bus or wake up in the hospital.

Our latest audit garnered this comment from the auditors:

"Technology administration duties do not appear to be adequately segregated among the current staff due to the liberal use of domain administrator privileges ... The organization should define what each staff member does with respect to the system and adjust group membership and access rights accordingly. It is important that no single person be in a position to completely compromise the system. XXX company should look for areas where this two-person control can be implemented so that each employee can audit the work of another."

Huh? I am the only person who fully understands the system. How do I segregate my duties when no one else is trained to perform them? I'm not going to give up backups, or active directory, or firewall security, or .... just because an auditor thinks there should be two of me. We're too small to have two high end IT people.

Oh, and my boss has a sealed envelope with all passwords and a network diagram in case I wake up dead and they have to bring in another admin. My helpers couldn't brief my replacement. ;-)

by jbaker

tell what color hats everybody here wears. I think that we, as Systems and Network Administrators should at least be aware of what the vulnerabilities are, and how they are exploited. It would help us to secure our networks.

by jmgarvin

I was being playful. It would be very nice to have a hacking section to help with basic admin stuff or to even post the good stuff like Snort rules or spiffy tools for your toolbox.

by oz_media

At that point you may as well join the box network and get links to and from Astalavista.

I just don't think it's a preferred focus here.

by lbowser

When your server or workstation won't boot, you need ERD Commander 2005 ERD Commander 2005 boots dead systems directly from CD into a Windows-like environment. You'll have full access to the dead system's volumes, so you can diagnose and repair problems using tools located on the ERD Commander 2005 Start menu. And you'll have built-in network access to safely move data off of, or on to, the dead system. The Locksmith utility allows you to quickly reset the Administrator password on locked-out systems. With ERD Commander 2005 you can repair a system quickly and easily, saving you time and rescuing your critical data.

by bmedlock

This is the way to go. I've used it on more than one occasion. It's the easiest way to reset the Admin password. There are other ways...
But I digress...
Winternals is the EASIEST!

by nelwoods

No one person should have all of the system passwords. Here I have the written, sealed in an envelope which is signed across the seal by myself and the HR Director. The envelope is kept in the vault. This protects my employer should something happen to me.

by jmgarvin

I would be nice to have a community of admin hackers that could get together and talk about things here.

How many times have you thought: Gee, I wish I knew what other admins had in their tool boxes!

It would be nice to also talk about work arounds, white hat/grey hat stuff and maybe even have black hat info.

I'd also like to see a red team/blue team community where we had "safe" hacking of various stuff..

This discussion is closed to new replies.