3

Watching a video series about Active Directory and doing security based on tiers. You have the main administrators in Tier-0 and End users in Tier-2 for example sakes.

The idea is administrator level users never have access to anything but tier-0 to avoid token compromises ect.. You also avoid generic accounts for audit purposes.

My question is this. You are an administrator and you work heavily in Tier-0, but you also work in Tier-2 where you access the internet, emails and remote into other Tier-2 machines for remote desktop work. Do you generally create another account for Tier-0 work or assign yourself privileges do that level on a need to use basis?

2 Answers 2

2

Microsoft is suggesting that you do both.

This is a part of their PowerShell v5 paradigm known as JIT/JEA (or JitJea) aka Just In Time, Just Enough Administration.

1

Where I've seen this done, separate accounts were used.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .