Download as PDF, PPTX
Uploaded byBeyondTrust
8-step Guide to Administering Windows without Domain Admin Privileges
The document presents an 8-step guide for administering Windows systems without requiring domain admin privileges, highlighting the risks of privileged account usage and best practices to mitigate those risks. Key steps include enforcing role separation, limiting privileged group memberships, and using tools like PowerShell and privileged access management solutions. The importance of managing administrative access and monitoring is emphasized to prevent privilege abuse and enhance security.
More Related Content
Similar to 8-step Guide to Administering Windows without Domain Admin Privileges
![20260201 [FOSDEM] gomodjail - library sandboxing for Go modules.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/20260201fosdemgomodjail-librarysandboxingforgomodules-260201225659-76609ec4-thumbnail.jpg?width=640&height=640&fit=bounds)
8-step Guide to Administering Windows without Domain Admin Privileges
- 1. 8-Step Guide toAdministering Windows Without Domain Admin Privileges Presenter: IT Security Consultant Russell Smith @smithrussell
- 2.
- 3.
- 4. Do you issueIT staff with domain admin privileges?
- 5. Privileged access =Increased RISK
- 6. Risks Associated withPrivileged Account Use ▪ Malware, viruses, and ransomware ▪ Pass-the-Hash and Pass-the-Token attacks ▪ Brute-force attacks ▪ Unsanctioned configuration changes ▪ Ability to disable security defences ▪ Data leakage ▪ Privilege abuse
- 7. Privileged Accounts NotRequired ▪ Everyday AD management tasks ▪ Connecting to remote devices using Remote Desktop ▪ Using PowerShell Remoting ▪ Managing end-user devices ▪ Managing servers
- 8. 1. Enforce Separationof Administration
- 9.
- 10. Separate Roles DC DNS DHCPExchange File server
- 11. 2. Enforce LeastPrivilege by Limiting Privileged Group Membership
- 12. Enforce Least Privilegeby Limiting Privileged Group Membership Domain Admins Enterprise Admins Schema Admins
- 13. Enforce Least Privilegeby Limiting Privileged Group Membership Domain Admins Enterprise Admins Schema Admins
- 14. Enforce Least Privilegeby Limiting Privileged Group Membership Domain Admins Enterprise Admins Schema Admins Backup Operators Print Operators Group Policy Owner Creators Read-only Domain Controllers Server Operators BUILTINAdministrators Cryptographic Operators Account Operators Domain Controllers
- 15. 3. Fine-Grained User/Privileged UserAccount Management
- 16. Privileged User AccountManagement Domain Admins Enterprise Admins Schema Admins Custom OU
- 17. Privileged User AccountManagement Domain Admins Enterprise Admins Schema Admins Custom OU
- 18. Delegation of ControlWizard (ADUC)
- 19. Delegation of ControlWizard (ADUC) Remote Server Administration Tools (RSAT) Standard user managing Active Directory
- 20. 4. Manage Administrative Accessto End-User Devices
- 21. Group Policy Preferencesor Restricted Groups Policy
- 22. 5. Manage PrivilegedAccess to Servers
- 23. Local Administrator PasswordSolution (LAPS) Active Directory
- 24. Manage Privileged Accessto Servers AD group 'Server 1' AD group 'Server 2' AD group 'Server 3'
- 25. Manage Privileged Accessto Servers AD group 'Server 1' AD group 'Server 2' AD group 'Server 3' BUILTIN Admini strators BUILTIN Admini strators BUILTIN Admini strators
- 26. 6. Leverage PowerShellJust Enough Administration
- 27. Leverage PowerShell JustEnough Administration PowerShell Remoting ServerManagement PC Default Endpoint Groups: Administrators, Remote Management Users Exposes all cmdlets, modules, and functions
- 28. Leverage PowerShell JustEnough Administration PowerShell Remoting ServerManagement PC Constrained Endpoint Groups: Any Limited cmdlets, modules, and functions Per-session JEA account (optional)
- 29. 7. Use PrivilegedAccess Management Across Domain Controllers
- 30. Leverage PowerShell JustEnough Administration ▪ Privileged Access Management (PAM) ▪ Tiered AD administration ▪ Privileged Access Workstations (PAWs)
- 31. Privileged Access Managementin Windows Server 2016
- 32. TIER 0 Privileged AccessWorkstations PAW PAW PAW DC RSAT
- 33. 8. Enable WSUSand Centralize Events
- 34. TIER 0 Windows ServerUpdate Services (WSUS) WSUS DC
- 35. Windows Event Forwarding Collector DCTIER 0 TIER 1
- 36.
- 37. Who is BeyondTrust? EXPERIENCED Preventsprivilege abuse and stops data breaches for 4,000+ customers worldwideCOMPLETE PAM SOLUTION Integrated privilege & vulnerability management, threat & behavioral analytics LEADER Gartner, Forrester, KuppingerCole
- 38. BeyondTrust Stops theCyber Attack Chain • Reduce attack surfaces by eliminating credential sharing, enforcing least privilege, and prioritizing and patching system vulnerabilities • Monitor and audit sessions for unauthorized access, changes to files and directories, and compliance • Analyze behavior to detect suspicious user, account and asset activity
- 39. Endpoint Privilege Management Remove excessiveuser privileges and control applications on endpoints WINDOWS | MAC Enterprise Password Security Provide accountability and control over privileged credentials and sessions APPS | DATABASES | DEVICES SSH KEYS | CLOUD | VIRTUAL Server Privilege Management Control, audit and simplify access for DevOps and business-critical systems UNIX | LINUX | WINDOWS ASSET & ACCOUNT DISCOVERY THREAT & VULNERABILITY INTELLIGENCE & BEHAVIORAL ANALYTICS REPORTING & CONNECTORS POLICY & ACTION RESPONSE THE POWERBROKER PRIVILEGED ACCESS MANAGEMENT PLATFORM BeyondInsight
- 40. Comprehensive Windows PrivilegeManagement Dynamic Access Policy Comprehensive Least Privilege Privileged Threat Analytics Remote System & Application Control Auditing & Governance File & Policy Integrity Monitoring Privilege Management Best Practices
- 41.
- 42. Quick Poll +Q&A Thank you for attending!