1

Coming from a Linux background, this seems awful weird to me. Unlike Linux, where root login is denied by default in SSHd configuration, Windows users in Administrator group are allowed to login by default via RDP.

RDP Screenshot

I believe it would make more sense, to follow the principle of least privileges and defense-in-stages. Instead of exposing the administrator account for remote logins, it makes more sense to allow ONLY non-admin accounts so that, even if there are any breaches, it is possibly contained.

So, what could possibly be the reason behind this decision of exposing Admin accounts by default?

  • I'm not sure this is a security question. Why an OS made a decision is really up to them. There are obvious security implications, but "why?" is not a security question. – schroeder May 4 '17 at 6:49
  • @schroeder Yes, you are right. It is a design decision which impacts security. I am just curious to know if there are any possible justifications (in terms of security) why Windows considers this to be an acceptable risk? – gtux May 4 '17 at 7:17
  • My guess is that it's a convenience thing. Once you enable it, your admin can then connect and configure it. – schroeder May 4 '17 at 8:08
  • easy: microsoft wants to make life easier for the people who get paid to support windows. – dandavis May 5 '17 at 21:54
1

Starting at least with NT4, Windows uses the notion of domain of administration, and the administration of a machine is normally done through the network. This is a general design decision: if you know an administrator account of a machine (or of the domains it belongs to) and if the system has not be tweaked to remove default services, you can have access to any disk through the administrative shares (\\HOST\C$), you can connect to its registry, and you can generally manage its users and shares.

The RDP follows same principle: if you are allowed to administer a machine, you should have all priviledges on it. Simply you can also allow other users to use it in addition to the administrators.

Be it or not a best design is another question, but it is Windows general design.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.