There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc.
The only requirement for administrative access within our estate would be to install or update software; with most software deployed centrally through SCCM. As such, any requirement would be an IT service desk agent or field technician making ad-hoc changes to a machine, or possibly a developer. There are no requirements for standard users to be local machine administrators.
In the process of creating a reasonable POLP (Principle of least Privilege) policy, we determined that all users should have standard desktop user accounts, and secondary administrative accounts; with the intention being that any requirement to make local changes will be challenged with a UAC, requiring different credentials.
Not only will this stop any malicious processes running in their environment from executing using their account privileges, it also acts as a 'psychological fireguard' to ensure they are being made aware they are making local changes. Additionally, should their standard account be compromised (they have emails, for example), the compromised accounts are not Administrative.
Now, the above seemed logical to me at first glance, but a colleague has since challenged the proposal.
I respect the colleague immensely and he has many, many years of experience in IT; but his challenge was that his standard account has Local administrative privileges on his own machine, and that with UAC turned on this should be sufficiently protected.
Is he Right?
Some of the users would need their ADM accounts linked to a group that populates local administrators to all machines on the domain; putting their standard accounts into that membership seems like a huge risk to me, but is simply enabling UAC prompts sufficient?