I've been reading through the MS advice on mitigating PtH and their first and primary suggestion is to have separate accounts for workstation admins, server admins, and domain controller admins.
I am a team of 1 actual IT guy and my boss who is technically in IT but doesn't know anything about IT and 1 other person who can reset AD users passwords. Right now my boss and I are domain admins and logon with those credentials for everyday use. The person who does password resets is a standard user with local admin privileges (so she can open RSAT) who has delegated permissions for password resets.
So let me get this straight, in an ideal situation... 1) My boss and I should have 4 separate accounts?! 1 standard, 1 workstation admin, 1 server admin, and 1 domain admin account. 2) The password admin should have 2 accounts, 1 password admin and 1 standard user? 3) We are supposed to restrict logons to the machine that has the role, so server admin account can only logon to fileservers/appserver and domain admin account can only log onto domain controllers?
So barring the fact that I am some how supposed to remember 4 separate AD account passwords, how many workstations do I need to do my job? If I'm supposed to be logging into my primary workstation with my standard user account to do things like read email how am I supposed to add a new user or change a group policy? My DC's are server core installations and I was managing things through RSAT on my local workstation but now am I supposed to RDP to a jump server and then manage users through that? What about the password administrator, is she supposed to do the same to a completely different workstation to reset passwords? What about changing folder permissions, can I RDP to the file servers with the server account permissions without exposing the server admins credentials?
I can tell you if it requires all PS administration I would actually not mind it so much but my boss will never figure it out. I would love to hear an eloquent solution to the problem or have someone tell me that I'm over thinking things. Please help me...