1

At work, we've recently received a recommendation to have two separate accounts for domain administrators. One account would be a standard user account with no admin privileges and one would be a member of Domain Admins. While I can understand why this recommendation is being made, it seems like a royal pain as well.

I know that UAC manages this type of privilege escalation in a mostly transparent way. Is UAC or another solution capable of providing this level of protection?

3
  • 3
    I'd have thought separate accounts was standard practise everywhere? Every organisation I've ever been involved with has worked this way!
    – Bryan
    Jan 19, 2012 at 15:13
  • @Bryan We do not in my organization. There's very few people with Domain Admin privilege and we make good use of UAC. It works well for us.
    – Chris S
    Jan 19, 2012 at 15:22
  • @ChrisS - Fair enough. Personally it isn't something that I'd even consider, even more so, since I once worked with someone who 'over-used' their privileged account, and ended up getting bitten. It wasn't pretty.
    – Bryan
    Jan 19, 2012 at 15:32

3 Answers 3

6

Yes and no, it depends on your comfort with the risks involved. UAC definitely provides a layer of protection, akin to sudo in the linux world. However, if you just get used to blindly clicking Yes on all UAC prompts then the protection is somewhat reduced. If your account is straight-up not authorized to perform those actions then the accidental dismissal of a UAC prompt is not a danger.

Of course there are still dangers of being logged in under the domain admin account, but it's much more of an intentional action and you can separate the authorizations a lot more by having dual accounts. It also affords your organization an easier way to remove authorizations in the case that someone changes job function.

2
  • It seems that the problems you mentioned would be mitigated by JudasIscariot1651's first configuration recommendation (Admin Approval Mode = Prompt for Credentials). Is there any other concern that you would have?
    – bshacklett
    Jan 19, 2012 at 17:29
  • Prompt For Credentials does not mitigate the issues in my second paragraph. With just UAC, if an admin changes job function then all of his authorizations are still tied to his own ID and they would all need to be found and removed. If you use multiple accounts then the admin account just needs to be disabled / removed. Much easer, much safer.
    – squillman
    Jan 19, 2012 at 17:36
2

It is not so simple.

With 2 accounts, a Domain User and a Domain Admin, you get complete seperation between your role as user of the systems and your role as administrator of the systems.

With UAC, you only accomplish the seperation of privileges. Your SID always remains the same and you can't seperate the two roles with ACL's for example. Either you have access, or you don't.

If you really want to only have one user, make sure that you set the following 2 UAC settings in your Default Domain Policy:

  1. Behavior of the elevation prompt for administrators in Admin Approval Mode = Prompt for Credentials

  2. Run all administrators in Admin Approval Mode = Enabled

0

I would personally separate your accounts completely and enable admin approval mode with prompt for credentials across the board. You can then have complete separation of your accounts and privileges within an ACL. Whenever you elevate it prompts for credentials.

I have a separate account for user, domain admin, general server admin, and workstation admin. Depending on which rights I need to have for an action or app I enter the relevant credentials in the UAC prompt and only ever log in as my user account.

3
  • 1
    How does this work when doing remote administration via MMC, regedit, etc.?
    – bshacklett
    Jan 19, 2012 at 16:46
  • @bshacklett You run them as a different user.
    – squillman
    Jan 19, 2012 at 16:48
  • squillman is right. You run regedit or MMC as the account with rights.
    – SonoIT
    Jan 20, 2012 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .