Hello all...
I'm looking to do some kind of auditing in order to determine necessity of certain local user accounts being members of the local admin group. These are various web servers- 2003, 2008 OS's- no AD..stand alone servers. There's several user accounts in the local admin group and I'd like to remove them if possible to increase security. These accounts are used primarily for scripting and web app related functions...and if possible, I'd like to be able to see if they actually need to have admin rights. I did not obviously setup these web servers up or develop the app code..... and there's no documentation or knowledge transfer on why these accounts were placed in the admin group to begin with.
Not sure that the stock windows auditing would be of much value from what I can see. I also considered removing the accounts one a time and see what breaks- but this is not really a feasible options on these production systems...plus that would be painstaking
Any insight or help on this would be a big help.........Dennis
