Default Domain Admin cannot by secured "Smart card is required for interactive logon"

[githubths]

Hi Windows Server Team,

The recommendation in the document is contradictory and cannot be implemented like this. The document recommended to set Default Domain Admin account with the account option "Smart card is required for interactive logon".

Controls for Built-in Administrator Accounts Setting : Enable the Smart card is required for interactive logon flag on the account

Based on test and the following link, a 128 bit random password is set for an account when setting the account option "Smart card is required for interactive logon". As a result, no one knows the password of the default domain admin after activating the account option. To use the account, the account option must first be deactivated and a new password must be set.

Configure user accounts to disallow password authentication When you configure a user account for SCRIL, Active Directory changes the affected user's password to a random 128 bits of data

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/passwordless-strategy#configure-user-accounts-to-disallow-password-authentication

Here is the contradiction to the AD Forest Recovery Guide. In the AD Forest Recovery Guide it is mandatory to know the password of the Default Domain Admin, because only with this password it is possible to log in without GC. But in a recovery case nobody knows the password of the default domain admin, because the account option "Smart card is required for interactive logon" was set. This leads to the fact that a forest recovery is no longer possible.

Rehost all GCs Warning: The password of the Domain Administrator account for all domains must be ready for use in case a problem prevents access to a GC for logon.

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-single-domain-in-multidomain-recovery#rehost-all-gcs

What is valid? Should the default domain admin be configured with the account option or do we need to know the password of the default domain admin in case of recovery scenario.

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: a861650d-0499-c46b-7ca8-d1fb04546192
• Version Independent ID: 3967b664-f419-6e8e-5ad8-f98cdcb21733
• Content: Appendix D - Securing Built-In Administrator Accounts in Active Directory
• Content Source: WindowsServerDocs/identity/ad-ds/plan/security-best-practices/Appendix-D--Securing-Built-In-Administrator-Accounts-in-Active-Directory.md
• Product: windows-server
• Technology: ad-ds
• GitHub Login: @iainfoulds
• Microsoft Alias: daveba

[Kuenni]

+1 for some guidance!

My opinion: I would recommend against setting SCRIL because of the mentioned forest recovery scenario. Instead I would plan for proper password strength, storage of password, retrieval processes and good monitoring of the account.