{"id":6148,"date":"2017-09-28T16:14:45","date_gmt":"2017-09-28T15:14:45","guid":{"rendered":"https:\/\/www.n-able.com\/?p=6148"},"modified":"2021-04-09T16:15:10","modified_gmt":"2021-04-09T15:15:10","slug":"4-steps-managing-local-admin-rights","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights","title":{"rendered":"4 Steps to Managing Local Admin Rights"},"content":{"rendered":"

We\u2019ve always known leaving the local user with admin rights was never a good idea. If your business is still in \u201cbreak\/fix\u201d mode, you may have quite a few users left with admin rights because it\u2019s much easier for you to fix their problems remotely. I completely get that\u2014we\u2019ve all been there.<\/p>\n

But, when the reality of risk around both external and internal attacks sets in, you quickly realize that giving out any kinds of elevated permissions can have dire consequences. All an external attacker needs is local admin rights to establish a foothold in one of your customer\u2019s environments. Same goes for ransomware\u2014give it admin rights and everything from files up to the bios can be affected. While it\u2019s tempting to give out admin rights, you could be asking for trouble.<\/p>\n

So, what are some of the ways to manage local admin rights?<\/em><\/p>\n

First off, the answer is a really big \u201cit depends,\u201d because not every MSP business runs the same.\u00a0 So, for the purposes of this article, I\u2019m going to start with some simple recommendations and then move towards the more taxing (and expensive) ones.<\/p>\n

Let\u2019s start with taking away admin rights from the user.<\/p>\n

Step 1: Implement Least Privilege<\/h3>\n

\"restricted_access.jpg\"The first step is determining what privileges\u2014beyond that of a local admin\u2014do users\u00a0really<\/em>\u00a0need. In nearly every case,\u00a0none<\/em>\u00a0of your users truly\u00a0needs<\/em>\u00a0elevated privileges. So, we begin with ensuring that users have no local admin rights. A simple run of the command\u00a0net local group administrators<\/em>,<\/i>\u00a0and you\u2019ll have yourself a list of anyone with local rights. The idea behind least privilege is to assign each user as little privilege as possible. So, instead of \u201creaching high\u201d on this one, \u201cgo for low.\u201d<\/p>\n

Step 2: Implement User Account Control<\/h3>\n

If you want to allow users to make certain OS changes, the best way to facilitate this from a security perspective is to separate out a user\u2019s \u201cregular\u201d user account (for use when they are surfing the web, running Office apps, etc.) and give them a separate local admin account for when they need to make changes to the OS. Configure UAC to prompt for credentials when an operation requires elevated privileges\u2014that way, they aren\u2019t using elevated privileges all the time, and they need to authenticate as the admin for changes that could impact the OS to be made.<\/p>\n

Step 3: Implement Privilege Management<\/h3>\n

\"deeper_access.jpg\"UAC is only good for OS changes. Should a user require elevated privileges for a specific application, for example, you\u2019ll need to take things a step further and look for a privilege management solution. These solutions define local policies of who and when elevated privileges are to be allowed. For example, say a payroll user uses an application that requires local admin rights. A privilege management solution can be configured to have the application run with elevated privileges while the user remains a regular user.<\/p>\n

Step 4: Implement Privileged Account Management (PAM)<\/h3>\n

One of the problems with Least Privilege and UAC is that when local admin accounts are used (regardless of whether the user logs on with the local admin account, uses UAC, etc.) credential artifacts\u2014such as clear text passwords, password hashes, and Kerberos tickets\u2014all remain in memory.\u00a0Cyberattackers<\/a>\u00a0know these artifacts exist and, should they be able to compromise a single local admin account, the credentials can be gathered and then utilized to access further systems within your network.<\/p>\n

This is why you may need to look at a PAM solution. While PAM solutions have many features, I want to focus this blog on just two: a\u00a0password vault<\/a>\u00a0and an ability to rotate passwords automatically. Here\u2019s the idea, a user must authenticate into a PAM solution as themselves. They are then given a local admin account\u2019s credentials from the vault to use to either log on with, or authenticate via UAC, etc. Once the user is done using the admin account, they check it back into the PAM solution, at which time the password is changed and the local admin account is updated.<\/p>\n

This puts the attacker at a severe disadvantage: should they be able to access any credential artifacts, none of them are valid any longer (because the passwords have all been changed by the PAM solution upon check-in).<\/p>\n

Putting a Lockdown on Local Admin Rights<\/h3>\n

Regardless of whether you follow all four steps or not, doing\u00a0something<\/em>\u00a0is better than leaving your users with local admin rights. You can offer each step as an additional tier of service, layering on deeper and deeper levels of security. Based on the needs of the customer and the security service offering tier they\u2019ve signed up for, by following one or more of the steps above, you\u2019ll have a much better handle on both who has local admin rights and how they are used.<\/p>\n

 <\/p>\n

Nick Cavalancia has over 20 years of enterprise IT experience and is an accomplished executive, consultant, trainer, speaker, and columnist. He has authored, co-authored and contributed to over a dozen books on Windows\u00ae<\/sup>, Active Directory\u00ae<\/sup>, Exchange\u2122<\/sup>\u00a0and other Microsoft\u00ae<\/sup>\u00a0technologies. Nick has also held executive positions at ScriptLogic\u00ae<\/sup>, SpectorSoft\u00ae<\/sup>\u00a0and Netwrix\u00ae<\/sup>\u00a0and now focuses on the evangelism of technology solutions.<\/em><\/p>\n

Follow Nick on Twitter\u00ae<\/sup>\u00a0at\u00a0@nickcavalancia<\/a><\/em><\/p>\n

 <\/p>\n

Click here<\/b><\/a>\u00a0to find out how SolarWinds MSP is using Machine Learning to help MSPs protect their customers and also do their jobs more effectively.<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

Read the 4-step process to managing local admin rights to help eliminate risk from potential attacks and reduce downtime.<\/p>\n","protected":false},"author":51,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-6148","post","type-post","status-publish","format-standard","hentry"],"acf":[],"yoast_head":"\n4 Local Admin Rights Management Steps - N-able<\/title>\n<meta name=\"description\" content=\"Read the 4-step process to managing local admin rights to help eliminate risk from potential attacks and reduce downtime.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"4 Local Admin Rights Management Steps - N-able\" \/>\n<meta property=\"og:description\" content=\"Read the 4-step process to managing local admin rights to help eliminate risk from potential attacks and reduce downtime.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2017-09-28T15:14:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-04-09T15:15:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg\" \/>\n<meta name=\"author\" content=\"Nick Cavalancia\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nick Cavalancia\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights\"},\"author\":{\"name\":\"Nick Cavalancia\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/4e0156a83ca71f429d1af500f8dac549\"},\"headline\":\"4 Steps to Managing Local Admin Rights\",\"datePublished\":\"2017-09-28T16:14:45+01:00\",\"dateModified\":\"2021-04-09T15:15:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights\"},\"wordCount\":919,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#organization\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg\",\"articleSection\":[\"IT Support\"],\"inLanguage\":\"pt-BR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights\",\"url\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights\",\"name\":\"4 Local Admin Rights Management Steps - N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg\",\"datePublished\":\"2017-09-28T16:14:45+01:00\",\"dateModified\":\"2021-04-09T15:15:10+00:00\",\"description\":\"Read the 4-step process to managing local admin rights to help eliminate risk from potential attacks and reduce downtime.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#primaryimage\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"IT Support\",\"item\":\"https:\/\/www.n-able.com\/pt-br\/blog\/category\/it-support-pt-br\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"4 Steps to Managing Local Admin Rights\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#website\",\"url\":\"https:\/\/www.n-able.com\/pt-br\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/pt-br?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/pt-br\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/4e0156a83ca71f429d1af500f8dac549\",\"name\":\"Nick Cavalancia\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g\",\"caption\":\"Nick Cavalancia\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"4 Local Admin Rights Management Steps - N-able","description":"Read the 4-step process to managing local admin rights to help eliminate risk from potential attacks and reduce downtime.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights","og_locale":"pt_BR","og_type":"article","og_title":"4 Local Admin Rights Management Steps - N-able","og_description":"Read the 4-step process to managing local admin rights to help eliminate risk from potential attacks and reduce downtime.","og_url":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2017-09-28T15:14:45+00:00","article_modified_time":"2021-04-09T15:15:10+00:00","og_image":[{"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg","type":"","width":"","height":""}],"author":"Nick Cavalancia","twitter_card":"summary_large_image","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Escrito por":"Nick Cavalancia","Est. tempo de leitura":"5 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights"},"author":{"name":"Nick Cavalancia","@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/4e0156a83ca71f429d1af500f8dac549"},"headline":"4 Steps to Managing Local Admin Rights","datePublished":"2017-09-28T16:14:45+01:00","dateModified":"2021-04-09T15:15:10+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights"},"wordCount":919,"publisher":{"@id":"https:\/\/www.n-able.com\/pt-br#organization"},"image":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#primaryimage"},"thumbnailUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg","articleSection":["IT Support"],"inLanguage":"pt-BR"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights","url":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights","name":"4 Local Admin Rights Management Steps - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/pt-br#website"},"primaryImageOfPage":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#primaryimage"},"image":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#primaryimage"},"thumbnailUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg","datePublished":"2017-09-28T16:14:45+01:00","dateModified":"2021-04-09T15:15:10+00:00","description":"Read the 4-step process to managing local admin rights to help eliminate risk from potential attacks and reduce downtime.","breadcrumb":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#primaryimage","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/blog\/2017\/09\/restricted_access.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/4-steps-managing-local-admin-rights#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"IT Support","item":"https:\/\/www.n-able.com\/pt-br\/blog\/category\/it-support-pt-br"},{"@type":"ListItem","position":2,"name":"4 Steps to Managing Local Admin Rights"}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/pt-br#website","url":"https:\/\/www.n-able.com\/pt-br","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/pt-br#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/pt-br?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/pt-br#organization","name":"N-able","url":"https:\/\/www.n-able.com\/pt-br","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/4e0156a83ca71f429d1af500f8dac549","name":"Nick Cavalancia","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4082bc26b8621c709a9d01d3269690e7760cce48ac67f8a46ea0a195818c1189?s=96&d=mm&r=g","caption":"Nick Cavalancia"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/posts\/6148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/comments?post=6148"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/posts\/6148\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/media?parent=6148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}