Questions tagged [privileged-account]

A user account with permissions to perform administrative actions within an operating system or application.

Filter by
Sorted by
Tagged with
0 votes
0 answers
29 views

Recommendations for admins who administer multiple environments

What's the recommendation for an organisation with admins who administer multiple environments? For example, we have the same administrator with privileged access to different Microsoft Entra Id ...
Jay 's user avatar
  • 71
0 votes
0 answers
50 views

Are domain admin credentials cached when entered for approving a software installation?

From what I know, it's a bad practice to login to any workstation or server except domain controllers as a domain admin. I read that mimikatz or other malware can extract the hash of the password from ...
rocky_alpine's user avatar
2 votes
0 answers
43 views

What to do in case of an MDM solution admin account takeover?

My company recently switched to an MDM solution to manage our Apple computers fleet. This is all good and well to maintain up-to-date software, and make handle lost/stolen laptop issues. But I can ...
securious's user avatar
0 votes
0 answers
1k views

ERROR kuhl_sekurlsa_acquireLSA from customized mimikatz

Tried to call sekurlsa::logonpasswords function from mimikatz main source, but I get ERROR hl_aaaurlsa_acquireLSA ; Logon list The program is executed with Administrator cred and I'm sure there's no ...
zbx0310's user avatar
1 vote
3 answers
2k views

Is there really any benefit in having a separate local admin account

I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
TheGreyShadow's user avatar
1 vote
0 answers
79 views

Clarification on log4j Service Requirements [duplicate]

We're currently trying to prioritize our mitigations for CVE-2021-44228. The obvious priority is to deal with any Internet facing java (apache?) applications that use a vulnerable log4j library and\or ...
BradleyMorgan's user avatar
1 vote
1 answer
373 views

How is using the standard Windows account more secure than using the administrator Windows account with highest UAC settings?

If someone uses the administrator Windows account for everyday work while having the default UAC settings they will be prompted by UAC whenever an application other than certain predefined system apps ...
gaazkam's user avatar
  • 5,747
0 votes
0 answers
114 views

How many emails and accounts an organization's administrator and developer should have?

Let's say there is a small organization called "Example" with the registered domain "example.com". There is a person, Bob, who has full control over the organization's GitHub ...
accountsandemailsquestion's user avatar
0 votes
1 answer
386 views

How do I stop local users from bypassing the UAC on Windows 10?

I'm the admin for a Windows 10 machine with a few local users. While I understand there are other ways to bypass security with access to the physical machine, I'd like to protect against hacks that ...
Hooked's user avatar
  • 304
1 vote
3 answers
821 views

Why is it not recommended to permanently use the root account for all tasks?

Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422 But I still fail to understand the reasoning behind this ...
gaazkam's user avatar
  • 5,747
4 votes
1 answer
1k views

Why do I need root privileges to send a raw packet from a UNIX machine?

I was recently reading through the nmap port scanning documentation and it points out that to perform a SYN scan (-sS) you require root privileges because an unprivileged user cannot send raw packets. ...
0x003's user avatar
  • 98
3 votes
2 answers
2k views

What are the security risks to have admin rights for a user account on Windows 10?

I am considering the security risks to have a standard user added to the Administrators group on an enterprise Windows 10 machine that is dedicated to that user. This is related to security only, so ...
WoJ's user avatar
  • 9,028
0 votes
1 answer
156 views

server access to application owners

I am looking for the right practice to provide access to application owners. As of now they are part of system admins groups. whoever part of the group login tho the servers any time and do any stuff. ...
moorthyrv's user avatar
1 vote
2 answers
623 views

Setup guide for Privileged Access Workstation on Windows 10

I am setting up a Privileged Access Workstation (PAW) to access a whitelist of websites. Currently I have been following this guide on Github by unassassinable and applying the latest Windows 10 ...
PMC's user avatar
  • 111
3 votes
2 answers
187 views

Applying "principle of least privilege" when it comes to execs and owners of the company - should they automatically get all permissions if requested?

As an administrator of certain systems in a company I understand and adhere to the "principle of least privilege" -- which I'm assuming I don't need to repeat its definition here, so let's just say ...
c1864473's user avatar
1 vote
1 answer
205 views

Risk of Docker backdoor allowing impersonation

I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux. I work in a company which is developing some ...
hex0x02's user avatar
  • 13
2 votes
0 answers
141 views

Best practices or advice to convince IT admins not to map network drives in privileged sessions with users

We are currently trying to enhance the security posture of our company, and this means changing how some IT personnel work. Put precisely, our IT helpdesk currently have 2 separate accounts: 1 for ...
Ob1lan's user avatar
  • 123
1 vote
2 answers
146 views

Insider threat mitigation sql databases

I support a number of applications some of which have sql databases. There's a number of scripts (mostly powershell/bash) to check the state of an application to see if it's considered healthy. Some ...
bain2236's user avatar
1 vote
1 answer
255 views

Running jobs as local administrator vs domain administrator and their risks

I know for best practices we should always give an account least privilege and use that account to run jobs etc. However our windows jobs often require elevated privileges in order to perform the ...
JinPangPang's user avatar
  • 1,951
1 vote
3 answers
133 views

Is "permission (role) granting" safer, than giving direct access to primary account?

The role assignment is excellent feature over the various platforms (Google, GitHub, Facebook, etc. ). However, I've been thinking about a specific security "threat" which might arise from that. Let'...
T.Todua's user avatar
  • 2,727
2 votes
3 answers
454 views

What's the best practical way to protect our IT administrators?

We're a medium-sized enterprise with many different IT administrators (e.g. domain admins, Azure admins, DB admins, ...). We're worried that hackers can easily breach an admin's laptop and through ...
Tom Alexander's user avatar
0 votes
0 answers
294 views

How to run command as privileged Windows service account against Active Directory domain controller?

I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test). Since the account is a service account, it cannot be ...
Shuzheng's user avatar
  • 1,207
0 votes
1 answer
286 views

Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc. The only requirement for administrative access ...
John Smith Optional's user avatar
3 votes
3 answers
323 views

Why is it recommended to use accounts without sysop rights for everyday work?

Another recommendation I fail to understand. The explanation is that, if I use admin account and manage to have my computer infected, the malware is able to take control over my entire system. But: ...
gaazkam's user avatar
  • 5,747
1 vote
3 answers
298 views

Do large companies storing private user data ensure no single insider can abuse user data? if so, how?

Let's say we have a large company X which stores private user information. For example an e-mail provider, or social network provider. I mainly have GMail and Facebook in mind. So the company has ...
proggie165's user avatar
2 votes
2 answers
424 views

Does clicking "no" to "Do you want to allow the following program ... to make changes to this computer" mean I'm safe?

I recently got an unwanted exe automatically downloaded by my browser, and on going to delete it my useless trackpad registered misplaced my click and I ran it. I got the usual dialog about making ...
Lucas's user avatar
  • 1,019
0 votes
1 answer
652 views

Mysql user privileges for update query

In Mysql DBMS is it possible to assign USAGE privileges to a user which can do an update query? In order to prevent SQL-injection.
Bob's user avatar
  • 139
1 vote
1 answer
453 views

Mysql Information schema column_privileges empty

I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose. In one of these I obtain the table column_privileges (of Mysql Information schema) ...
Bob's user avatar
  • 139
21 votes
2 answers
8k views

Backdoor account in passwd file

Long story short I was making sure a web app didn't create a LFI vuln by attempting to open /etc/passwd with it. My first attempt to prevent LFI was unsuccessful and listed out the file, and I noticed ...
CarlosAllende's user avatar
3 votes
3 answers
405 views

Should inactive administrator accounts be DELETED/expunged?

Given: A web application Some active administrator accounts. Some inactive administrator accounts. No existing "audit" mechanism to keep old accounts for. Inactive administrators cannot log in. Is ...
Kzqai's user avatar
  • 133
79 votes
8 answers
11k views

Should the sole user of a *nix system have two accounts?

Should the sole user of a *nix (particularly Linux and MacOS) have two accounts, one with sudo privileges and one without? Years ago I read that on your personal computer you should do your daily ...
Ender Wiggin's user avatar
34 votes
4 answers
5k views

Why is it a bad idea for management to have constant access to every employee's inbox?

This was prompted by my CEO asking to get permanent access to everyone's inbox. He wants for his email client to be configured so that as well as his own email account, he can see the contents/...
BlackHatGuy's user avatar
0 votes
3 answers
1k views

Software installations without local admin rights

In the light of fewer technicians to visit sites and install software on to PC's, users are requesting Local Admin rights to do it themselves. Is there a safe way or procedure of doing this for users ...
Luke's user avatar
  • 51
1 vote
2 answers
131 views

Why do websites still suffer from OS injections if by default web-servers are not assigned a shell?

So even if there is some poor php written which allows a shell_exec() and that someone disabled safe mode on it, what exactly are the risks? Do admins just change the default group or are most attacks ...
whatever489's user avatar
-1 votes
1 answer
327 views

How does the ERAD device gain access to your personal bank account?

I am trying to get specifics on how exactly this ERAD device is able to access and withdraw from personal bank accounts. http://www.dailykos.com/stories/2016/6/8/1536190/-Oklahoma-has-started-using-...
dooode's user avatar
  • 109
3 votes
5 answers
2k views

May be justified to use generic and shared user accounts in order to segregate and reduce risk?

Imagine I have a group of users called "support" that participates solving different kinds of problems. Each user has a nominal username like jsmith that has not much privileges but additional ...
Eloy Roldán Paredes's user avatar
3 votes
2 answers
8k views

Default accounts shutdown, halt, and sync - still shipping?

I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document), sync:x:5:0:sync:/sbin:/bin/...
Mike McManus's user avatar
  • 1,345
1 vote
4 answers
3k views

Is it safer to be setup as a user with 'standard' vs 'administrative' privileges in Windows 10?

I am setting up a relatives computer using Windows 10. I am going to create them a 'standard user' account which I will encourage them to use as their every day account. In addition to that I will ...
n00b's user avatar
  • 445
2 votes
1 answer
1k views

In Windows, what should I do to run a program with admin rights without concerns?

I'm currently using Windows 8.1 - 64 bits. In my computer, I have 2 accounts, 1 with admin power (used to install programs), and another without admin power (for everyday usage). There's a certain ...
ThatOldPencil's user avatar
3 votes
1 answer
139 views

Citations for Least Privilege network services?

The Principal of Least Privilege suggests that network services should not run with powerful and unnecessary capabilities. History teaches us that this is painfully necessary; 25 years ago Sendmail ...
gowenfawr's user avatar
  • 72.7k
30 votes
4 answers
4k views

Can the root user be removed from a *nix system to prevent privilege-escalation?

Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent super-...
Whome's user avatar
  • 1,239
1 vote
3 answers
204 views

Root access and malware

Would it help to defend against malware if I use a less privileged Windows 7 account for my day-to-day work?
David Bryant's user avatar
  • 1,129
5 votes
1 answer
168 views

How can I objectively evaluate trust in a person? (Systems Admin, or other)

When recruiting for positions that require a level of integrity and trust, I'm looking for objective ways of accessing that, either positively or negatively. Is there any any guidance one should use ...
makerofthings7's user avatar
3 votes
3 answers
10k views

Is it dangerous to have the built-in Administrator account enabled?

I've seen it said that when using the built-in Windows Administrator account, the best practice is to enable it (net user administrator /active:yes), use it, and then disable it. I do realize it's a ...
ispiro's user avatar
  • 773
1 vote
1 answer
1k views

Is it ok to have GRANT ANY ROLE privilege granted to an Oracle account which is expired & locked?

I know it's not considered secure to grant GRANT ANY ROLE privilege to other users apart from admins. But what if the user is expired & locked? In particular, I see these 2 users having this ...
ZygD's user avatar
  • 267
0 votes
1 answer
716 views

What's a least-privilege way to allow node.js to access network adapters on Linux?

Linux naturally restricts all but superuser from pulling traffic directly from network adapters. In the case of Wireshark/dumpcap, setuid root is used ONLY for dumpcap, restricting the privileges ...
bright-star's user avatar
4 votes
4 answers
11k views

Postfix master running as root

Does running /usr/lib/postfix/master as a root could cause a security threat ? A fresh installation, gives this : root 11622 0.0 0.0 4792 1432 ? Ss 19:11 0:00 /usr/lib/postfix/...
4m1nh4j1's user avatar
  • 181
0 votes
1 answer
686 views

Limiting account access based upon NIC used to connect on Linux

I have a server which has multiple NICs (ignoring redundant pairs): 'inward' facing production (connects to other servers); 'outward' external facing production (connects out to the internet via a ...
Hiding From The Jackasses's user avatar
0 votes
1 answer
568 views

How should privileged accounts be secured in both Linux and Windows?

I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
appsecguy's user avatar
  • 435
1 vote
2 answers
160 views

How many accounts should I have in an information system?

Is it a problem to have more than one account in an information system from security point of view? Let me clarify a bit. It is a bank system. I wonder if having a CSO (customer service officer) ...
Sray's user avatar
  • 29