My boss installs software using domain admin. Should I show that this is bad?

Question

At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to enter credentials. Not only is this painful for everyone involved, but Domain Admin privileges are used 100% of the time. We recently had a disgruntled employee try to do some damage on their way out of the company, and if they had access to this account (which really would have been trivial to do) the results could have been disastrous.

I want to explain and or demonstrate why this is such bad practice, but a) I am a permanent casual employee (still at uni) and b) there is another department head who is very paranoid about a very outdated/misguided view of security, and I imagine they would take great offense. To top this all off, the IT service provider we are with is utterly incompetent, so even if this practice is not by their design, they certainly wouldn’t take any steps to prevent it.

Is it advisable to in any way approach either the director or my manager about why this is hopelessly insecure, or should I just bide my time and hope there is no incident while I am at the company.

For the record, IT support or admin is in no way shape or form a part of my job description, though I am well known in the office as the computer guy that can get things done.

Answer 1

Using domain admin in the current days is like totally ignoring the network security and opening up the gates to the attackers! With tons of security breaches being announced everyday, Active Directory security in an enterprise plays a key role.

Below links detail the common mistakes of Active Directory deployments and the attacks because of the malpractices!

https://blog.netwrix.com/2017/11/22/active-directory-management-top-7-common-mistakes/

https://www.peerlyst.com/posts/taking-windows-domain-lateral-movement-to-the-next-level-mimikatz-less-instant-lateral-movement-claus-cramon

Below link is an exhaustive list on various security considerations for Active Directory deployments!

https://activedirectorypro.com/active-directory-security-best-practices/

I agree that there are members of senior management who doesn't bother about security, but it's the matter of survival in the digital era. With one small loophole in your network, you might end up as a victim with irreparable damage.

Cheers!