Physical or VM for Admin Jumpbox

[Guest Guest]

My daily driver account is a Domain Admin (I know) and that’s something I’m going to change.

 

What are others using for Admin Jump boxes? I’m thinking physical is probably better in case of failure but a VM on one of our HyperV hosts is an option

 

Thanks

[RobD]

Its a VM for me but you could host a VM somewhere else in case you have hyper v issues, maybe in the cloud if you're happy to set it up?

[Davit2005]

You certainly want a separate elevated account that gives you enough permission for your daily tasks :-)

 

If you have more than one hyper V you could put a jump host on both.

 

I'd certainly look at what you want to accomplish with the jump as a first step then work from there.

Edited May 25, 2023 by Davit2005

[fiza]

How do you secure your jump boxes? I am looking to do this too but need some guidance on securing the workstation.

[Davit2005]

Think about what you want isolation wise, use a specific user account/group, decide whether the jump box needs Internet access, whether it needs to be only accessible by specific machines etc. Edited May 25, 2023 by Davit2005

[BOOT]

Here is some guidance on configuring secure-administrative-hosts or 'jump boxes':

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-secure-administrative-hosts

 

And some guidance from NCSC on what NOT to do:

https://www.ncsc.gov.uk/whitepaper/security-architecture-anti-patterns

 

Particularly on 'browsing up'

[Jaan]

Here we have non domain physical PCs with local accounts only. They have their C:/ bitlocked and have the enterprise sophos av,firewall rules etc etc. We remote into Domain tech vms we each have from the cluster as and when we need.

[localzuk]

Here is some guidance on configuring secure-administrative-hosts or 'jump boxes':

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-secure-administrative-hosts

And some guidance from NCSC on what NOT to do:

https://www.ncsc.gov.uk/whitepaper/security-architecture-anti-patterns

Particularly on 'browsing up'

Interesting! So, "daily driver" activities should be done on a separate machine - be that machine a VM connected to from your client, or a separate physical machine... So, potentially, if you use a single RDS VM for admin tasks, you could end up effectively with 2 VMs to connect to? One for daily driver activities, one for admin tasks?

 

As I wouldn't want to install all the admin tools on desktops in our office.

[fiza]

Here we have non domain physical PCs with local accounts only. They have their C:/ bitlocked and have the enterprise sophos av,firewall rules etc etc. We remote into Domain tech vms we each have from the cluster as and when we need.

Can you explain a little more how that works please?

 

Your day to day tasks are done on the non domain physical PCs logged in with local accounts?

What accounts do you use to remote int domain tech VMs? What level of admin privilege do these accounts have?

[Jaan]

Our Day to tasks are done on the Physical PCs as we are primarily a Google Site and use a lot of Cloud based stuffs. Our Tech VMs that are domain connected. From the Vms we remote into the specific servers to do tasks if/when needed. We have to authenticate against our Tech vms With domain admin credentials.

 

We dont access LAN resources from our physical PCs, we download to our physical PCs and copy Paste via the Remote desktop Session. We don't UNC into network resources etc.

 

I'm sure there's a better way, but like the OP, we felt like we needed to do something different.

 

hope that helps

 

EDIT: we have RSAT on the Tech VMs also

 

EDIT2: We also use ultrawides which helps

Edited May 25, 2023 by Jaan

[Jcx500]

My DC Jump boxes aren’t domain joined, on isolated vlan with only access to management infrastructure

[Jobos]

While Googling what a jump box was I came across this that is a good read and not too dry at all.

 

https://www.csoonline.com/article/2612700/security-jump-boxes-improve-security-if-you-set-them-up-right.html