When reading many sources on performing authenticated vulnerability scans, it has been mentioned that creating and using a separate admin (privileged) user account for scans is recommended rather than using an existing privileged user account.

May I know the risks involved in performing the scans using an original admin user account?


Let me see if I understand your question. You want to enter the live, admin password into an automated tool? And you are unclear on the risks of doing that?

A few things come to mind:

  • the distribution and storage of the live admin password across multiple "users"
  • the sharing of an admin password for multiple purposes
  • the lack of positive attribution of any actions performed to the scanner or the admin
  • the inability to easily disable the admin password if the scanning tool is compromised
  • the inability to lock out the scanner's credentials outside of expected scanning windows
  • the inability to limit the scope of the scanning admin account
  • the violation of "principle of least privilege" and "separation of duties"
  • the various compliance issues that might arise

The scanning account needs to be distinct to each scanner so that its effects can be limited, the actions of the scanner can be properly attributed, and the credentials can be disabled if compromised.

No one should know the system/domain admin password but the admin...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.