There are several benefits to managing administrative accounts separately from regular user accounts.
- Ordinary user activity, like email or web browsing, is done without special admin privileges, limiting the scope of an attack, and increasing the difficulty of exploiting an attack.
- Logging in as an admin with a static password can leave hashes on a box that can be picked up by an attacker and reused in a “pass the hash” attack. If a domain admin logs on to a desktop box, and that box is later the victim of a phish, their credential hash may remain live until the password is changed! A checkout account with a rotating password invalidates those hashes as soon as the password is changed.
- Checkout accounts give visibility and auditability to the use of elevated privileges. Letting a manager audit one specific account’s use can be done without granting full audit permissions to every account for that manager.
- Checkout account systems can have their own authentication mechanisms, giving the ability to add multi-factor authentication (like TOTP) to older or closed systems that can’t otherwise support 2FA.
Most of these benefits can be derived by using a centralized tool to manage those accounts and passwords in your organization. There are several external products that can manage passwords dynamically; they have their pros and cons.
The enterprise licensed version of HashiCorp Vault has a module that can update the passwords, but it requires credentials with administrative access into AD to make those changes. They also have a RESTful API for conveniently accessing credentials programmatically from other systems. Their system is well suited to securely store passwords for automated systems such as CI/CD pipelines.
CyberArk Password Vault allows for timed credentials designed for "checkout accounts"; you check out a username/password from the vault and it automatically changes the AD password when the timer pops, or when the user checks the account back in. (I believe it can also lockout the account if something goes wrong.) You can also set it up so the user can reset their own checkout accounts. They have a "local agent" you can install that can remotely access credentials programmatically (for CI/CD use), but it's quite awkward to access and use. They're well suited to manual checkout of IDs for emergency use.
BeyondTrust Software offers Password Safe and DevOps Secrets Safe, which also fit similarly into those two problem spaces.
All these solutions provide ways for administrators to reset and revoke passwords, report on usage, etc. They're one way to control privileged access, and the audit trail can help your SOC identify the source of issues and incidents. And they all come with a price tag, so you can weigh that in the decision process, too.