Is it unsafe to enter administrative Windows credentials when logged in as a regular user?

Question

I was recently advised that when a user is logged in as a regular user and they need an administrator to do something (i.e. install an application) that entering the administrator credentials when the regular logged in user is still logged in, puts the credentials at great risk and logging out as the regular user and logging in as the administrator is the recommended course of action. Is this correct?

Answer 1

This is true. To input user administrator credentials on a normal workstation is a security risk. There are various risks if the workstation is infected on your daily actions, like stealing hashes to later re-use them in pass-the-hash (PTH) attacks, installing keylogger, etc.

There's even a risk if you use a jump host, this is because upon creating a RDP session the hashes are still created on your workstation. Credential Guard is a great way to have a good protection from PTH attacks, but this still doesn't help if the workstation is infected with a keylogger. https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard

Microsoft has introduced PAW Priviledged Access Workstation to have a secure mechanism of managing Administrative tasks. These are basically hardened Windows OS machines on which you perform Administrative tasks. https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations

If you would like to go a step further, you can setup a tiered architecture on your Active Directory infrastructure. https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material