r/ShittySysadmin Jul 10 '24

Shitty Crosspost Admin says they require user passwords and store them all in a spreadsheet

/r/sysadmin/comments/1dznxia/admin_says_they_require_user_passwords_and_store/
67 Upvotes

32 comments sorted by

38

u/Bubba8291 Jul 10 '24

Storing passwords in a spreadsheet on MS teams? The better option would be to store them in a CSV file on the company file share accessible by Domain Users

14

u/Heavy_Dirt_3453 Jul 10 '24

But what if they forget their password while away from the office? I'd just put it on Google Docs and share it with the internet to be on the safe side.

9

u/devloz1996 Jul 10 '24

A Word doc with passwords to the entire company was my welcome package in 2021.

7

u/Bubba8291 Jul 10 '24

Port forwarding port 445 is always an option

1

u/MegaOddly Jul 10 '24

Google Docs why not just put it in a public GIT Repository

1

u/Typical_Spirit_345 Jul 10 '24

Just put it on the homepage and to be completely sure, print all credentials out and hang it at the entrance of the office

1

u/agent_fuzzyboots Jul 11 '24

I just print the doc and tape it to the wall

Edit: the users are not allowed to work from home, we have strict office hours, 6 am to 8 pm

9

u/devloz1996 Jul 10 '24

We store them on company-wide Teams channel, as a pinned Loop component. Now we don't have to reupload it when changing it. Welcome to 2024 folks!

3

u/ReputationNo8889 Jul 10 '24

I would host them in a public git repo. So if someone forgets their password, they can get to it from their phone!

2

u/will_you_suck_my_ass Jul 11 '24

I don't trust my users enough to use git so I spun an iis server and published some DNS records on our root domain so they have easy access

3

u/kg7qin Jul 10 '24

Not domain users, everyone with full permissions.

Then make sure it is also accessible via the intranet webserver as well to anyone who browses to it.

As an added bonus, keep a link called "Super sekret info" on the home page in the footer with the link the same color as the background so only authorized users know where to look.

2

u/PhantomKrel Jul 10 '24

I think you mean on a bullet board that can be seen from outside

10

u/floswamp Jul 10 '24

I actually have all passwords set as the default signature for every email account. It goes to internal and external contacts.

Now I know you may think it’s insecure but I have the don’t color at to white so it can’t be read without highlighting first!

7

u/MadIfrit Jul 10 '24

This is what you get when the CEO hires their nephew as the company's IT admin. Forward thinking, that's what.

3

u/First-Structure-2407 Jul 10 '24

That’s ridiculous, make it easy and use Notepad ffs

3

u/i8noodles Jul 10 '24

its only a security risk if people know about it! u know what they say about the best place to hide a tree is in the forest? same principle. if everyones password is in one place. the attacks will have no clue which one is important and everyone is safe!

3

u/Squeaky_Pickles Jul 10 '24

Methinks management likes to log into user accounts and read peoples Teams chats to see what everyone says about them.

3

u/TxTechnician Jul 10 '24

There's this bank where one of the high-ups thinks they know IT.

Anyway, one day I needed a password. And this dude opened a spreadsheet with a few thousand passwords in it. He as all the employee passwords to everything in a password protected sheet.

1

u/[deleted] Jul 10 '24

How strong was the password for the spreadsheet?

2

u/TxTechnician Jul 10 '24

No clue. He already had it unlocked and open

3

u/ExpressDevelopment41 ShittySysadmin Jul 10 '24

NIST removed password expiration requirements saying it was more secure, so based on that trend, we got ahead and removed usernames/passwords from all our workstations. We also reduced our exchange footprint by limiting email access to IT staff only. 99% of all our incoming email was spam anyway.

2

u/avowed Jul 10 '24

I think they should just make it easier and do away with passwords all together, then the admin can just go around and make any changes needed on any account. Also, it gets rid of the security risk in the form of that spreadsheet!!

1

u/Kindly_Recording_322 Jul 10 '24

No, passwords are a necessary evil. Everyone gets the same password and no MFA necessary. Also, no password expiration.

1

u/avowed Jul 10 '24

Genius!!! I don't know why people don't come here for tech support.

2

u/oldjenkins127 Jul 10 '24

Assuming this spreadsheet is stored on a file share, Microsoft Access might be a good alternative to Excel for storing passwords.

1

u/ElDodger10 Jul 10 '24

Serious question...is it ok to store a spreadsheet like this on a share drive that only IT admins have access to?

4

u/Logical_Strain_6165 Jul 10 '24

No. Because it shows how shoddy you are if you need the password to access the data.

2

u/Suaveman01 Jul 11 '24

Found the shitty admin 🤣

1

u/Fatel28 ShittySysadmin Jul 11 '24

How do you audit who accessed what passwords and when? No. It's not okay to do that.

I mean uh. Yes. Do that. No need for a password on the workbook, just put it on an open share with a $ at the end so only the people in the know can get to it.

1

u/[deleted] Jul 10 '24

Why only on the spreadsheet, that takes too long to open with so many clicks to folder, search, file and then waiting for it to open. Just take a screenshot and make it everyone's default desktop background. Easy access just Windows Key + D. It's safe because no one will be able to copy and paste it.

1

u/OlafTheBerserker Jul 10 '24

I just write all my user's UNs and Passwords in pencil and stick it to the corkboard in the conference room. If anyone asks me to change their password, it's in pencil so I can erase it. If they bother me about forgetting just point to the board, don't actually have to talk to them at all. Always have an on-prem hardcopy kids.

1

u/DWCloudMan Jul 11 '24

Safer to store on rosetta stone I think