Are you administrators of network devices

[robjduk]

Hello all,

I'm working through some recommendations from a security audit and wanted to know the community's thoughts on IT staff having administrator rights on network machines. I'm walking the tightrope between security and usability and unsure how to proceed.

 

Scenario A is I add us to the administrator group of staff and student devices and we carry on as before however this continues our accounts being able to cause problems should our accounts ever become compromised. Doesn't really fix the issue. I could argue we have the AV ramped up to 11 on our computers but still, its open to exploit.

 

Scenario B is we don't give ourselves access, maybe set up a file share for easy transfer of files and either install fixes via PDQ or if needs be, locally with a LAPS password. In reality, the times I have had to remotely do anything other than drag the odd file over is few and far between.

 

Scenario C is to invest in some remote support software which would be nice but an expense I don't really want to take on.

 

My first plan was to add IT staff to the Users group to allow us to browse the laptop and make a shared folder with permissions however I have found no group outside of administrator will allow us the access I had hoped for.

 

What are you all doing? Total lockdown of rights or something a little lighter?

 

Thank you

[MatthewL]

You should run with 2 accounts at least, a normal user for day to day logging into your machine, an admin account to admin machines and use only when needed and if you wanted to go this way a third for admin on servers or elevate rights on your other one used for admin of desktops etc. Your normal account should have no more admin permissions to desktops than a standard user, if you really need to make a local admin on your machine but I advise our lot not to but have the option. That way your working the same as a user so you can see if there are also any issues too.

[Frodo_Baggins]

Back when we were using Active Directory IT staff use standard user accounts and elevate when needed to a separate account with a complex password - Conditional access\ roles setup (created new groups as needed, and followed all the usual best practices.)

More information on your environment and user size might help others with their answers (remote access tool like Senso or other is always useful)

[robjduk]

Thank you. The dual accounts seem the route to go.

[Fazza]

Thank you. The dual accounts seem the route to go.

 

It works well for us, it is a PITA though having to put an admin username and password in every time we want to do anything but it also shows the end users that Cyber Security affects us all!

[TechMonkey]

We have 3 accounts, may be going to 4.

 

1) Day to day account. Same as everyone else

2) local admin for elevating access on PCs

3) server admin for server work

4) looking to setup 365 admin accounts as currently using our daily drivers but this is very bad practice.

 

On a different note, if you can do get a decent remote support software. Not knowing your site but being able to solve an issue in 5 minutes by jumping on to their machine is a lot better than wandering across the site, especially if you then find they are not there and having to return later. Even just jumping on while you are on the phone to look at an error or to talk them through something saves so much time. Makes you and your team more efficient so will probably save you money in the long run.

[CHiLL]

I started running two accounts earlier this year, a standard user account for my main day-to-day at my desk and a domain admin account for specific tasks. I've changed my shortcuts to require admin privilages to run, so if I load ADUC, SCCM, Server Manager, etc...it prompts to to authenticate with my domain admin account. The biggest issue I had was related to folder permissions on shares. We had specified domain admins to have full control over all folders and we could make folder changes. Now as a non-domain admin, I can't make those changes without logging onto the server as my domain admin account. Instead, I created a new group for IT Admins and added myself and domain admins as members, then added IT Admins with full control to the shares. That way, I can make changes without being logged in as an admin.

 

I have a question about the non-admin account for those that use one - do you make it a power user/local admin of your workstation? I find it gets very annoying when I'm installing/testing stuff.

Edited October 11, 2023 by CHiLL

[Mako]

4) looking to setup 365 admin accounts as currently using our daily drivers but this is very bad practice.

 

Look at Privileged Identity Management in Azure if you want to avoid fixed accounts with statically assigned roles.

 

Senior IT staff have separate admin accounts but technicians have been assigned just-in-time roles in PIM which, depending on the role they want to elevate, may require admin approval. They have to fill in a box which details the reason (or in our case, the ticket #) for elevating for auditing purposes. All elevations require MFA approval. It does mean that if a tech's day-to-day account was compromised, the attacker would severely struggle to access those permissions as they'd also need the tech's MFA which is no different then a separate account being compromised.

 

The roles can be customised to detail how long the privileged access is granted, and whether or not that role needs admin approval etc.

Edited October 11, 2023 by Mako

[TechMonkey]

I have a question about the non-admin account for those that use one - do you make it a power user/local admin of your workstation? I find it gets very annoying when I'm installing/testing stuff.

 

I did in the past but stopped as my machine would be the worst to be compromised and potentially the most likely. It is also a good reminder what staff have to deal with so can flag errors or ssues before the staff notice or it becomes too much of an issue.

[localzuk]

We use a multi-faceted admin setup here.

 

The IT team has 2 accounts each, their daily use one, and a domain admin one.

 

The domain admin passwords only work for server related tasks and cannot be used to log into client machines at all.

 

We then have LAPS in place, which gives each client PC its own unique local admin password.

[FN-GM]

We have 26 IT staff

 

2 domain admins. They can only login to domain controllers and nothing else. MFA protected.

 

A number of accounts with elevated access to specific sections and functions of Active Directory, file shares etc. They cannot log into workstations. MFA protected.

 

Standard user accounts for day to day.

 

Nobody at all is a Local Admin. All apps are installed via SCCM / Intune (migrating at the moment). If someone needs a local admin we use LAPS. This has to be approved someone who is a one of the domains admins. It has to be a very good reason and logged. Password is automatically reset the day after. It’s not even a weekly occurrence that a LAPS password is used. The security team also provide OTP codes for any executables.

 

Yes having 3 accounts and using LAPS is a pain. A cyber attack would be worse.

Edited October 11, 2023 by FN-GM

[jaynes]

Sounds like we might be unique, we are a school IT Dept and we have Admin rights as standard. Just need to make sure to have MFA and conditional access policies on Entra.

[CHiLL]

I did in the past but stopped as my machine would be the worst to be compromised and potentially the most likely. It is also a good reminder what staff have to deal with so can flag errors or ssues before the staff notice or it becomes too much of an issue.

Yeah, these are just quirks I'm working through atm. There's only two of us here and I'm the guinea pig at the moment. My colleague will likely make the switch soon.

 

Sounds like we might be unique, we are a school IT Dept and we have Admin rights as standard. Just need to make sure to have MFA and conditional access policies on Entra.

That's how we ran it for years, but if your machine gets infected by something and you're logged on with account that can do everything, no amount of MFA or conditional access will help and it could wreak havoc on your network.

[localzuk]

Sounds like we might be unique, we are a school IT Dept and we have Admin rights as standard. Just need to make sure to have MFA and conditional access policies on Entra.

It is inadvisable to run this way. Modern guidance is to split it up. https://www.ncsc.gov.uk/guidance/systems-administration-architectures

[elsiegee40]

It is inadvisable to run this way. Modern guidance is to split it up. https://www.ncsc.gov.uk/guidance/systems-administration-architectures

 

I’m antique in IT terms and it was advised even way back when. I always operated with more than one set of credentials. It reduced the risk of me making disastrous mistakes and, by having the same privileges as the rest of the users, I was in tune if things stopped working!

[psydii]

Related to the other thread - we have:

 

* daily driver accounts as per all staff.

* local administrator account which is a basic domain user, unless it is also a member of specific localadminstrator group(s).

* server administrator account which are basic domain users, unless it is also a member of a specific serveradministrator group(s)

 

A very small number of DA accounts for Domain Controllers - and elevating the other accounts into and out of the various admin groups.

 

All users and computers have an associated local administrator group in AD. To get admin we can get our "local administrator account" added our to that group. The .\ADMINISTRATOR password is managed by LAPS.

 

All the accounts that can have administrative privelleges are in the Protected Users group. (except for the original "break-glass" Domain\Administrator)

 

For cloud based devices, we don't have a good solution. I abuse Defender remediation tools to add accounts to the local admin group, and then have to remember to abuse them again to remove the accounts. But that said we almost never need local admin on an Intune managed device.

 

Access to various 365 administrative functions required MFA protected accounts, and while currently handled by one of three seperate, cloud only GA accounts we are invreasingly moving to RBAM for these too.

Edited October 11, 2023 by psydii