Local Admin has Domain Admin rights
"Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one another, even though they may not be intended to have the same privileges.
Say we have a standalone PC, not joined to any domain. The PC is called
MyPC, and it has an account called
MyAdmin. The password for
Then we have a domain called
MyDomain. The network administrator decided to call a Domain Administrator account
MyAdminand, in a demonstration of sheer incompetence, gave it a password of
For whatever reason, a completely unfiltered network connection exists between
MyPCand all of the computers on
Any person who can log in to
MyPC\MyAdmincan exercise full Domain Administrator privileges on any system in
MyDomain, as if they had actually logged in as
MyDomain\MyAdmin, without being prompted to enter any additional credentials.
Intuitively, this seems wrong because (though they may have the same basic username & password)
MyDomain\MyAdmin are two different user accounts, created in different scopes, with different permissions. However, what actual security risks does this pose? How can those risks be mitigated, or how are they already mitigated by design? Does the risk change if the "rogue"
MyAdmin is a local account on a computer that is joined to the domain instead of just a random standalone system?