On Linux, we enforce least privilege through
sudo. This gives the best of both worlds: Passwords and accounts are for a person, as they should be, not a role. But we lower risk and exposure by only using privileges when we need them.
Windows doesn't typically have a similar scheme, and so, for admins, there are two options:
- Give them two accounts (Mike and MikeAsAdmin), one for general use, one when they need privileges.
- Give full privileges to their one and only account.
Microsoft is now pushing #1 as best practice. I have several concerns: Having multiple accounts for the same person makes it easy to miss one when, for example, the user leaves the org. If one account won't be used much, it makes it easier for problems to go unnoticed. In general, accounts and passwords are for identifying people, not roles. And, you haven't gained much security either: If the Mike account is compromised, it will lead itself pretty quickly to MikeAsAdmin.
This question applies to anything that lacks
sudo, not only Windows, but network equipment, applications, databases, cloud services, etc.: For all of these, is best practice for the admin to have a dedicated second account?