I was recently advised that when a user is logged in as a regular user and they need an administrator to do something (i.e. install an application) that entering the administrator credentials when the regular logged in user is still logged in, puts the credentials at great risk and logging out as the regular user and logging in as the administrator is the recommended course of action. Is this correct?

  • 1
    Windows has UIPI which attempts to reduce this risk, but I believe there are ways to bypass it. – forest Jul 30 '19 at 1:26

This is true. To input user administrator credentials on a normal workstation is a security risk. There are various risks if the workstation is infected on your daily actions, like stealing hashes to later re-use them in pass-the-hash (PTH) attacks, installing keylogger, etc.

There's even a risk if you use a jump host, this is because upon creating a RDP session the hashes are still created on your workstation. Credential Guard is a great way to have a good protection from PTH attacks, but this still doesn't help if the workstation is infected with a keylogger. https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard

Microsoft has introduced PAW Priviledged Access Workstation to have a secure mechanism of managing Administrative tasks. These are basically hardened Windows OS machines on which you perform Administrative tasks. https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations

If you would like to go a step further, you can setup a tiered architecture on your Active Directory infrastructure. https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material

  • 1
    Thank you for such a comprehensive reply. It is very helpful. It leads to a followup question. I'd like to put an instance of SpiceWorks on the network to monitor for patches and other things. SpiceWorks will need a Domain Admin account and I'm worried that I may be opening myself up to vulnerabilities by having SpiceWorks (with these credentials) on the network. Is it safe to run SpiceWorks with such powerful credentials? – Bill Greer Jul 30 '19 at 14:15
  • 1
    @BillGreer That's definetly an overkill, Domain Admin is basically the key to your kingdom. Do a research on what permissions Spiceworks needs to do the scan and configure an account with Least Privilege in mind. Here's a good starting point I found on a Google search by using local admin accounts, but do more research to affirm this is really the best and most secure practice for your particular environment community.spiceworks.com/how_to/…. – Raimonds Liepiņš Jul 30 '19 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.