I've been reading through the MS advice on mitigating PtH and their first and primary suggestion is to have separate accounts for workstation admins, server admins, and domain controller admins.

I am a team of 1 actual IT guy and my boss who is technically in IT but doesn't know anything about IT and 1 other person who can reset AD users passwords. Right now my boss and I are domain admins and logon with those credentials for everyday use. The person who does password resets is a standard user with local admin privileges (so she can open RSAT) who has delegated permissions for password resets.

So let me get this straight, in an ideal situation... 1) My boss and I should have 4 separate accounts?! 1 standard, 1 workstation admin, 1 server admin, and 1 domain admin account. 2) The password admin should have 2 accounts, 1 password admin and 1 standard user? 3) We are supposed to restrict logons to the machine that has the role, so server admin account can only logon to fileservers/appserver and domain admin account can only log onto domain controllers?

So barring the fact that I am some how supposed to remember 4 separate AD account passwords, how many workstations do I need to do my job? If I'm supposed to be logging into my primary workstation with my standard user account to do things like read email how am I supposed to add a new user or change a group policy? My DC's are server core installations and I was managing things through RSAT on my local workstation but now am I supposed to RDP to a jump server and then manage users through that? What about the password administrator, is she supposed to do the same to a completely different workstation to reset passwords? What about changing folder permissions, can I RDP to the file servers with the server account permissions without exposing the server admins credentials?

I can tell you if it requires all PS administration I would actually not mind it so much but my boss will never figure it out. I would love to hear an eloquent solution to the problem or have someone tell me that I'm over thinking things. Please help me...


Your password hash is typically left when you logon or RDP. So if you are using your admin account on your workstation, your password hash is there. Similarly, when you RDP to a server (except for newer OS), your hash is left there. This problem is mitigated in the Windows 10 OS codebase (Server 2016). You should have an admin server, and not log on with domain elevated rights to your workstation. You don't want to be using email or browsing the web using elevated rights or from a workstation where you routinely elevate or log on with elevated permissions.

You can RDP to the admin server, and administer from there. If you are using PowerShell to connect to the remote systems, you aren't leaving as hash. If you are using a smartcard, you can flip the smartcardrequired bit twice to invalidate your current password hash.

You can also consider using LAPS to put a random system maintained password on your Windows workstations. LAPS is free from Microsoft. This prevents the problem of a single workstation compromise taking down all workstations, and if you connect with the local administrator password for the machine, any compromise would be limited. The downside of using the local administrator password is auditing and that you may have to enable that via a GPO.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.