Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
    Bumped by Community user
    Bumped by Community user
    Bumped by Community user
    Bumped by Community user
    Bumped by Community user
    Bumped by Community user
    Bumped by Community user
3 added 468 characters in body
source | link

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications.

I’ve devised a few options:

  1. Create a domain security group (LocalPC AdministratorsAdmins), add the required domain user accounts, and use Group Policy to add the domain security group to the local security group Administrators:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
    • Cons:
      • Vulnerable to credential theft and lateral movement attacks.
  2. Option #1 but using separate domain user accounts (`firstname.lastname.admin”<original username>.admin):
    • Pros: Same as #1
    • Cons: Same as #1. Apparently, even authenticatingAuthenticating a UAC prompt creates a logon cache which can be exploited.
  3. Option #1 but disabling cached logons:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
      • Not as vulnerable to credential theft and lateral movement attacks in that there are no logon caches to exploit but credentials can still be captured via other means (keyloggers, etc).
    • Cons:
      • Users will be unable to logon if there’s a problem with the domain or, there's a problem with network connectivity, their PC is offsite, etc.
  4. Deploy Microsoft LAPS and issue users with the unique, local administrator credentials:
    • Pros:
      • Centrally-managed.
      • Not vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Non-auditable.
      • The default administrative user account is an easy target.
  5. Add the required domain user accounts to the local security group Administrators:
    • Pros:
      • Auditable (to an extent).
      • Not as vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Not centrally managed.
  6. Implement MFA:
  7. Implement a system that uses TOTPs and/or only temporarily grants administrative permissions as-and-when needed:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Not vulnerable to credential theft and lateral movement attacks?
    • Cons:
      • Not free.

What isIs there a general best practice / advised?

I can't help but get the feeling that there is no one correct technological answer and that these risks are mitigated by simply trying to ensure that no one can or will (1) use an administrative user acount on a day-to-day basis or (2) run malware.

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications.

I’ve devised a few options:

  1. Create a domain security group (Local Administrators), add the required domain user accounts, and use Group Policy to add the domain security group to the local security group Administrators:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
    • Cons:
      • Vulnerable to credential theft and lateral movement attacks.
  2. Option #1 but using separate domain user accounts (`firstname.lastname.admin”):
    • Pros: Same as #1
    • Cons: Same as #1. Apparently, even authenticating a UAC prompt creates a logon cache which can be exploited.
  3. Option #1 but disabling cached logons:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
      • Not as vulnerable to credential theft and lateral movement attacks.
    • Cons:
      • Users will be unable to logon if there’s a problem with the domain or their PC is offsite.
  4. Deploy Microsoft LAPS and issue users with the unique, local administrator credentials:
    • Pros:
      • Centrally-managed.
      • Not vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Non-auditable.
  5. Add the required domain user accounts to the local security group Administrators:
    • Pros:
      • Auditable (to an extent).
      • Not as vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Not centrally managed.
  6. Implement MFA:
  7. Implement a system that uses TOTPs and/or only temporarily grants administrative permissions as-and-when needed:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Not vulnerable to credential theft and lateral movement attacks?
    • Cons:
      • Not free.

What is best practice / advised?

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications.

I’ve devised a few options:

  1. Create a domain security group (PC Admins), add the required domain user accounts, and use Group Policy to add the domain security group to the local security group Administrators:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
    • Cons:
      • Vulnerable to credential theft and lateral movement attacks.
  2. Option #1 but using separate domain user accounts (<original username>.admin):
    • Pros: Same as #1
    • Cons: Same as #1. Authenticating a UAC prompt creates a logon cache which can be exploited.
  3. Option #1 but disabling cached logons:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
      • Not as vulnerable to credential theft and lateral movement attacks in that there are no logon caches to exploit but credentials can still be captured via other means (keyloggers, etc).
    • Cons:
      • Users will be unable to logon if there’s a problem with the domain, there's a problem with network connectivity, their PC is offsite, etc.
  4. Deploy Microsoft LAPS and issue users with the unique, local administrator credentials:
    • Pros:
      • Centrally-managed.
      • Not vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Non-auditable.
      • The default administrative user account is an easy target.
  5. Add the required domain user accounts to the local security group Administrators:
    • Pros:
      • Auditable (to an extent).
      • Not as vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Not centrally managed.
  6. Implement MFA:
  7. Implement a system that uses TOTPs and/or only temporarily grants administrative permissions as-and-when needed:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Not vulnerable to credential theft and lateral movement attacks?
    • Cons:
      • Not free.

Is there a general best practice?

I can't help but get the feeling that there is no one correct technological answer and that these risks are mitigated by simply trying to ensure that no one can or will (1) use an administrative user acount on a day-to-day basis or (2) run malware.

    Bumped by Community user
    Tweeted twitter.com/StackSecurity/status/930832129306578945
2 deleted 94 characters in body; edited title
source | link

Securely implementinggranting local administrative permissions

I’ve been researching the best method of securely implementinggranting local administrative permissions so that administrators can authenticate / elevate administrative tasks for standard users but I’m really struggling to reconcile the security, operational, and cost implications.

I’ve devised a few options:

  1. Create a domain security group (Local Administrators), add the required domain user accounts, and use Group Policy to add the domain security group to the local security group Administrators:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
    • Cons:
      • Vulnerable to credential theft and lateral movement attacks.
  2. Option #1 but using separate domain user accounts (`firstname.lastname.admin”):
    • Pros: Same as #1
    • Cons: Same as #1. Apparently, even authenticating a UAC prompt creates a logon cache which can be exploited.
  3. Option #1 but disabling cached logons:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
      • Not as vulnerable to credential theft and lateral movement attacks.
    • Cons:
      • Users will be unable to logon if there’s a problem with the domain or their PC is offsite.
  4. Deploy Microsoft LAPS and issue users with the unique, local administrator credentials:
    • Pros:
      • Centrally-managed.
      • Not vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Non-auditable.
  5. Add the required domain user accounts to the local security group Administrators:
    • Pros:
      • Auditable (to an extent).
      • Not as vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Not centrally managed.
  6. Implement MFA:
  7. Implement a system that uses TOTPs and/or only temporarily grants administrative permissions as-and-when needed:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Not vulnerable to credential theft and lateral movement attacks?
    • Cons:
      • Not free.

What is best practice / advised?

Securely implementing local administrative permissions

I’ve been researching the best method of securely implementing local administrative permissions so that administrators can authenticate / elevate administrative tasks for standard users but I’m really struggling to reconcile the security, operational, and cost implications.

I’ve devised a few options:

  1. Create a domain security group (Local Administrators), add the required domain user accounts, and use Group Policy to add the domain security group to the local security group Administrators:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
    • Cons:
      • Vulnerable to credential theft and lateral movement attacks.
  2. Option #1 but using separate domain user accounts (`firstname.lastname.admin”):
    • Pros: Same as #1
    • Cons: Same as #1. Apparently, even authenticating a UAC prompt creates a logon cache which can be exploited.
  3. Option #1 but disabling cached logons:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
      • Not as vulnerable to credential theft and lateral movement attacks.
    • Cons:
      • Users will be unable to logon if there’s a problem with the domain or their PC is offsite.
  4. Deploy Microsoft LAPS and issue users with the unique, local administrator credentials:
    • Pros:
      • Centrally-managed.
      • Not vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Non-auditable.
  5. Add the required domain user accounts to the local security group Administrators:
    • Pros:
      • Auditable (to an extent).
      • Not as vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Not centrally managed.
  6. Implement MFA:
  7. Implement a system that uses TOTPs and/or only temporarily grants administrative permissions as-and-when needed:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Not vulnerable to credential theft and lateral movement attacks?
    • Cons:
      • Not free.

What is best practice / advised?

Securely granting local administrative permissions

I’ve been researching the best method of securely granting local administrative permissions but I’m really struggling to reconcile the security, operational, and cost implications.

I’ve devised a few options:

  1. Create a domain security group (Local Administrators), add the required domain user accounts, and use Group Policy to add the domain security group to the local security group Administrators:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
    • Cons:
      • Vulnerable to credential theft and lateral movement attacks.
  2. Option #1 but using separate domain user accounts (`firstname.lastname.admin”):
    • Pros: Same as #1
    • Cons: Same as #1. Apparently, even authenticating a UAC prompt creates a logon cache which can be exploited.
  3. Option #1 but disabling cached logons:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
      • Not as vulnerable to credential theft and lateral movement attacks.
    • Cons:
      • Users will be unable to logon if there’s a problem with the domain or their PC is offsite.
  4. Deploy Microsoft LAPS and issue users with the unique, local administrator credentials:
    • Pros:
      • Centrally-managed.
      • Not vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Non-auditable.
  5. Add the required domain user accounts to the local security group Administrators:
    • Pros:
      • Auditable (to an extent).
      • Not as vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Not centrally managed.
  6. Implement MFA:
  7. Implement a system that uses TOTPs and/or only temporarily grants administrative permissions as-and-when needed:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Not vulnerable to credential theft and lateral movement attacks?
    • Cons:
      • Not free.

What is best practice / advised?

1
source | link

Securely implementing local administrative permissions

I’ve been researching the best method of securely implementing local administrative permissions so that administrators can authenticate / elevate administrative tasks for standard users but I’m really struggling to reconcile the security, operational, and cost implications.

I’ve devised a few options:

  1. Create a domain security group (Local Administrators), add the required domain user accounts, and use Group Policy to add the domain security group to the local security group Administrators:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
    • Cons:
      • Vulnerable to credential theft and lateral movement attacks.
  2. Option #1 but using separate domain user accounts (`firstname.lastname.admin”):
    • Pros: Same as #1
    • Cons: Same as #1. Apparently, even authenticating a UAC prompt creates a logon cache which can be exploited.
  3. Option #1 but disabling cached logons:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Free.
      • Not as vulnerable to credential theft and lateral movement attacks.
    • Cons:
      • Users will be unable to logon if there’s a problem with the domain or their PC is offsite.
  4. Deploy Microsoft LAPS and issue users with the unique, local administrator credentials:
    • Pros:
      • Centrally-managed.
      • Not vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Non-auditable.
  5. Add the required domain user accounts to the local security group Administrators:
    • Pros:
      • Auditable (to an extent).
      • Not as vulnerable to credential theft and lateral movement attacks.
      • Free.
    • Cons:
      • Not centrally managed.
  6. Implement MFA:
  7. Implement a system that uses TOTPs and/or only temporarily grants administrative permissions as-and-when needed:
    • Pros:
      • Centrally-managed.
      • Auditable.
      • Not vulnerable to credential theft and lateral movement attacks?
    • Cons:
      • Not free.

What is best practice / advised?