However, this is a dangerous approach from a security perspective.Īs a security best practice, even senior IT administrators who may legitimately need domain admin-level access, should not use this account for general day-to-day operations. This provides an easy way to ensure they can carry out tasks they may need, such as password resets. Often, helpdesk technicians and other IT staff are placed in the domain admins Active Directory group. With a domain admin account, an attacker has permissions to access just about any system or data on the network. Specifically, in Active Directory, this is known as a Domain Admin. The holy grail of account compromise is for an attacker to compromise an admin account. If an attacker compromises your account credentials, you want the “blast radius” of the security compromise to be as minimal as possible. However, to design security properly, you have to plan for compromise at some point.

In a perfect world, you want to have zero security compromises of your accounts. In that case, the attacker now has an account with far more capabilities than if it was provisioned correctly with least privilege access. Suppose an attacker compromises an end-user account with overprovisioned permissions (more than needed). Often, attackers who look to compromise an environment do so using compromised credentials. Let’s consider why the least privilege access model is essential in provisioning permissions, even for IT helpdesk staff.

Least privilege access – why vital for security?

Active directory ou permissions report