Alternatives for NTLM Authentication

Is this not the usual situation with service accounts and other credentials you would use to access an API?

Also, for what it’s worth, password expiration isn’t generally recommended anymore, with NIST SP 800-63-3 recommending that password resets be required only if the password is compromised or forgotten. Set that local account password to something absurdly long and computer-generated, put it in a scriptable password vault, then only use it when needed.

1 Like

In an ideal world, it shouldn’t be. It’s one thing to reset a password for an account that somebody lost the password to or something along those lines; it’s a different thing to be resetting passwords on periodic basis because there is no functionality for the account owner to reset their own password. I guess our company is still behind the times cause we still have to reset all service account passwords, irrespective of how secure the password is, once an year and we have like 30 different local RestAPI accounts (a lot of automations/data retrievals/integrations), so very time-consuming task!

1 Like