Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put administrative accounts in a separate "class" than regular accounts. They intentionally made it tough to be both an "Administrator" and a user of Activesync
I'm sure none of these design decisions regarding separation of administrative duties were made lightly, or without the input of several smart people.
My question is:
- What bad habits can an Administrator do that cancels out the benefit of having dual accounts?
- ie: checking email
- casual surfing the internet, versus surfing the internet to troubleshoot, diagnose, or validate an issue
- What are we protecting ourselves from?
- If an Administrator knows they may be visiting a hostile website, they are probably smart enough they should be testing this on an isolated network/machine
- Administrators usually aren't tricked into running scripts, or hostile code (ActiveX) that other users may be
Suppose a person's daily job is administration, and deals primarily with troubleshooting using their privileged credentials. It seems self-defeating and unproductive to ask them to "RunAs" for every new task.
Taking the last idea a step further, perhaps it would be better to RunAs for non-administrative tasks, such as email, file and print services, etc. Maybe they should use a virtual machine, VDI, etc to check email and update network diagrams (etc).
3 . Does it make sense for an Administrator to use his privileged credentials for signing into his PC, and using RunAs for non-administrative tasks?