Entra Admin Roles Block Routine Sysadmin Tasks
11 posts across 2 communities in the last 90 days; 82% from r/sysadmin.
“Best practice etc aside, you've proved to yourself that the issue is permissions related as adding it to the built in administrators group solves the problem. You said you have checked the logon as a service / batch job etc. Did you do this via the local policy or a group policy…”
“It's really app dependent. If you can't do EPM, sometimes turning off/down UAC is enough, sometimes giving FC to just the specific app folder or the specific app Key in HKLM is sufficient. But as always, thar be dragons”
“Is anyone else suffering from forced admin password resets at the moment? I’ve been forced mid session 3 times in the last fortnight to change my admin password. Totally at odds with the org wide and profile set password policies. Case open with support but not getting any…”
System administrators are struggling with complex permission issues, outdated systems, and the challenges of maintaining critical infrastructure. Specific problems include Entra admin role limitations, password rotation complexities for KRBTGT accounts, and dealing with failing hardware in legacy industrial equipment. These issues require significant troubleshooting and often involve workarounds.
SOURCES (16)
“Best practice etc aside, you've proved to yourself that the issue is permissions related as adding it to the built in administrators group solves the problem. You said you have checked the logon as a service / batch job etc. Did you do this via…”
“Most frustrating I’ve ever had was an onffshore guy who suddenly couldn’t login with his password anymore.. for weeks. guy: password is not working, kindly check it me: pls put your supervisor on the phone sup: yeah his password doesn’t work, please reset it me: i’ll give YOU the password, you check to see if it works sup: it works when i enter it, but when he enters it we can get an error me: ………….!!!!!!”
Hey everyone — question for those of you who administer Microsoft identity environments, whether that’s Active Directory, Microsoft Entra ID, or a hybrid environment . What are some actual support tickets /…
“How so? Because normal admins don't need two separate administrative accounts. Yes, I have a normal non-privileged user account, several different DA accounts for different domains, GA, several other break glass accounts (including a break glass PW vault account), and my normal admin account that is sync'd from AD to Azure. I do 95% of my work with my normal admin account. What is the benefit to that account being separate? It just causes more work and more opportunity for issues without”
“Our admins upgraded several weeks ago, no issues. Today our only method to log in is via password reset. Every single log in = new password or no access. submitted by /u/WildUnderstanding919 [link] [comments]”
“It was very clearly stated in the article. I'm just a dumbass. I kept skimming the titles and seeing admin vs non admin and just assumed it was that simple. Today my power users all got promoted to set up phishing resistant MFA. I didn't realize they had view all data permission. They don't even really need It, because they have view all on all the objects they need. So I just removed the global permission. This is what happens when Salesforce has a never ending list of changes to ad”
“I guess your boss isn't aware that you can block Domain Admins from being able to access your Linux servers (like you can with Windows, just the group is added by default). I map ours to specific groups for SSH and Sudo, Domain Admins aren't allowed in by default”
“It's really app dependent. If you can't do EPM, sometimes turning off/down UAC is enough, sometimes giving FC to just the specific app folder or the specific app Key in HKLM is sufficient. But as always, thar be dragons”
“New-ish to this sub. I work IT at a public-sector org and last week I found our network switch admin password on a sticky note — on the monitor in a shared office, facing the door. I thought that was rock bottom until a colleague showed me the "master spreadsheet": every server, every account, every password, one xlsx file, emailed around whenever someone new joins. The file name is literally "passwords_final_v7". Please tell me your horror stories so I feel less alone. What&”
“Had a user that would need help changing their password every few months. Granted, it was multiple devices, but it just never stuck. Tried walking them through it, but in the end, it was just faster to change it for them and make sure all the devices worked than deal with issues for a few days.”
“Is anyone else suffering from forced admin password resets at the moment? I’ve been forced mid session 3 times in the last fortnight to change my admin password. Totally at odds with the org wide and profile set password policies. Case open with support but not getting any answers yet. submitted by /u/AccomplishedPop3001 [link] [comments]”
“Actually, it kills every authentication for service account such as task scheduled and some application, we had to go on each service to reconnect and stuff like that. Overall, it wasn't that painful, some stuff have been mitigate without disturbing. The effect is in fact every user has to reauthenticate which was the main objective. We started to disabled some suspected account and the number of compromised activity was growing so after few logs we decided to shoot everyone which was kind o”
“Fellow admins, hope your day isn't going too long. Experiencing some weirdness with some admins not being able add auth methods to a particular user account. The admins already have the auth admin role and can modify any other user account. The particular user isn't an admin and I can't see anything special about it. The only role that can work is the priv auth admin. Has anyone experienced similar? submitted by /u/wubarrt [link] [comments]”
“I'm the sole sys-admin of my company that wears about 10 different hats depending on the day. I recently learned that rotating the password on the krbtgt is as Martha Stewart says "A good thing." To use another redditors wording, my krbtgt account is old enough to drink and then some. I'd like to reset the password and start rotating it at least once a year which is fine given our relatively small size. Our maximum lifetime for service ticket is 600 minutes, our maximum lifetim”