Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

At work, we've recently received a recommendation to have two separate accounts for domain administrators. One account would be a standard user account with no admin privileges and one would be a member of Domain Admins. While I can understand why this recommendation is being made, it seems like a royal pain as well.

I know that UAC manages this type of privilege escalation in a mostly transparent way. Is UAC or another solution capable of providing this level of protection?

share|improve this question
3  
I'd have thought separate accounts was standard practise everywhere? Every organisation I've ever been involved with has worked this way! –  Bryan Jan 19 '12 at 15:13
    
@Bryan We do not in my organization. There's very few people with Domain Admin privilege and we make good use of UAC. It works well for us. –  Chris S Jan 19 '12 at 15:22
    
@ChrisS - Fair enough. Personally it isn't something that I'd even consider, even more so, since I once worked with someone who 'over-used' their privileged account, and ended up getting bitten. It wasn't pretty. –  Bryan Jan 19 '12 at 15:32

3 Answers 3

up vote 6 down vote accepted

Yes and no, it depends on your comfort with the risks involved. UAC definitely provides a layer of protection, akin to sudo in the linux world. However, if you just get used to blindly clicking Yes on all UAC prompts then the protection is somewhat reduced. If your account is straight-up not authorized to perform those actions then the accidental dismissal of a UAC prompt is not a danger.

Of course there are still dangers of being logged in under the domain admin account, but it's much more of an intentional action and you can separate the authorizations a lot more by having dual accounts. It also affords your organization an easier way to remove authorizations in the case that someone changes job function.

share|improve this answer
    
It seems that the problems you mentioned would be mitigated by JudasIscariot1651's first configuration recommendation (Admin Approval Mode = Prompt for Credentials). Is there any other concern that you would have? –  bshacklett Jan 19 '12 at 17:29
    
Prompt For Credentials does not mitigate the issues in my second paragraph. With just UAC, if an admin changes job function then all of his authorizations are still tied to his own ID and they would all need to be found and removed. If you use multiple accounts then the admin account just needs to be disabled / removed. Much easer, much safer. –  squillman Jan 19 '12 at 17:36

It is not so simple.

With 2 accounts, a Domain User and a Domain Admin, you get complete seperation between your role as user of the systems and your role as administrator of the systems.

With UAC, you only accomplish the seperation of privileges. Your SID always remains the same and you can't seperate the two roles with ACL's for example. Either you have access, or you don't.

If you really want to only have one user, make sure that you set the following 2 UAC settings in your Default Domain Policy:

  1. Behavior of the elevation prompt for administrators in Admin Approval Mode = Prompt for Credentials

  2. Run all administrators in Admin Approval Mode = Enabled

share|improve this answer

I would personally separate your accounts completely and enable admin approval mode with prompt for credentials across the board. You can then have complete separation of your accounts and privileges within an ACL. Whenever you elevate it prompts for credentials.

I have a separate account for user, domain admin, general server admin, and workstation admin. Depending on which rights I need to have for an action or app I enter the relevant credentials in the UAC prompt and only ever log in as my user account.

share|improve this answer
1  
How does this work when doing remote administration via MMC, regedit, etc.? –  bshacklett Jan 19 '12 at 16:46
    
@bshacklett You run them as a different user. –  squillman Jan 19 '12 at 16:48
    
squillman is right. You run regedit or MMC as the account with rights. –  SonoIT Jan 20 '12 at 15:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.