4 ms·

Just a few ideas off the top of my head: An attacker that gains SYSTEM permissions on a machine can dump the SAM database, which may contain credentials for do

Just a few ideas off the top of my head: An attacker that gains SYSTEM permissions on a machine can dump the SAM database, which may contain credentials for domain or enterprise administrators. This is very bad. A user with administrator permissions can modify their DNS settings to avoid DNS-level filtering to block known malware domains. This can be bad. A malicious or ignorant user can disable or remove antivirus protection. This can be bad. A user can accidentally make a computer nonfunctional by, for example, deleting system files, perhaps because it was suggested (sarcastically) on a help forum ("LOL delete system32"). This is bad. I'm far from a security expert, but from a sysadmin perspective, every user having local admin privs is an absolute nightmare.

AnIdiotOnTheNet 8y ago
> An attacker that gains SYSTEM permissions on a machine can dump the SAM database, which may contain credentials for domain or enterprise administrators. This is very bad. True enough, but unlikely to be a significant risk. If you are concerned about it then it is much easier to have a separate AD account that only has local administrator on normal (non-admin) workstations and use that. > A user with administrator permissions can modify their DNS settings to avoid DNS-level filtering to block known malware domains. This can be bad. It is trivial to block or even reroute DNS queries to unapproved servers at the firewall. At least until DNS over HTTPS ruins that and simultaneously renders your point moot. > A malicious or ignorant user can disable or remove antivirus protection. This can be bad. I disagree. Anti-virus software has negative value and always causes significantly more trouble than it is worth. Case in point, the very issue we're talking about. > A user can accidentally make a computer nonfunctional by, for example, deleting system files, perhaps because it was suggested (sarcastically) on a help forum ("LOL delete system32"). This is bad. This is a minor inconvenience at best, that's what imaging is for. > I'm far from a security expert, but from a sysadmin perspective, every user having local admin privs is an absolute nightmare. If it were a nightmare, I'd have expected to see more issues arise from it throughout my career, but I've yet to see even one instance where a user having local admin has caused any significant trouble.
- KAMSPioneer 8y ago
  > True enough, but unlikely to be a significant risk. If you are concerned about it then it is much easier to have a separate AD account that only has local administrator on normal (non-admin) workstations and use that. I strongly disagree. If an attacker gains access to a system as an admin user, that is a much larger problem than a non-admin user. Designing an environment as you suggested helps compartmentalize that, but it doesn't help the fact that a SAM database from one of those machines can potentially spell an almost company-wide compromise. Such a strategy gives far too much opportunity for lateral movement in case of a single compromised machine. > It is trivial to block or even reroute DNS queries to unapproved servers at the firewall. That's a good point. >I disagree. Anti-virus software has negative value and always causes significantly more trouble than it is worth. Case in point, the very issue we're talking about. Regardless of your feelings on antivirus (I'm ambivalent myself), I don't quite see how a potential abuse of an antivirus software, which can lead to EoP, is justification for allowing all users in an enterprise to have full local admin privileges. You're cutting out the step where an attacker has to exploit an EoP vulnerability. > This is a minor inconvenience at best, that's what imaging is for. True, but if I can avoid the trouble by limiting user privileges, why not? > If it were a nightmare, I'd have expected to see more issues arise from it throughout my career, but I've yet to see even one instance where a user having local admin has caused any significant trouble. It's possible it may never be a problem in $arbitraryEnvironment, but that doesn't make it good security practices. I can imagine that in smaller environments, it may even be somewhat manageable. There will probably be circumstances that create a need for local admin access as you described, but I don't think it should be the modus operandi.
  - AnIdiotOnTheNet 8y ago
    > I strongly disagree. If an attacker gains access to a system as an admin user, that is a much larger problem than a non-admin user. Not really. There's quite a lot you can do as a non-admin user too you know. You can probe anything on the internal network that machine has access to and act as a relay for the attacker, for instance. Since the user does work for the company, they probably already have access to a lot of things the organization would rather not give out. Local admin gives you a few more options, but the difference isn't really worth special attention in my book. > True, but if I can avoid the trouble by limiting user privileges, why not? Because you're also causing a lot of friction for the users. Users do work too you know, in aggregate hopefully a lot more than sysadmins. Every barrier you put between them and their work is a cost, and my argument is that the cost of locking everyone out of local admin pretty much always outweighs the benefits. > I don't quite see how a potential abuse of an antivirus software, which can lead to EoP, is justification for allowing all users in an enterprise to have full local admin privileges. It isn't, it's justification for disregarding "could disable the virus scanner" as a valid reason for denying local admin to the user. "Good security practice" is often, in my experience, either a lot of academic crap that completely ignores the concept of risk analysis, or what someone who's trying to sell you something recommends. Every barrier you put between people and their ability to do work for the company is a cost that you have to justify against the cost of a compromise and the probability of said compromise actually occurring. Depending on your environment, that level of cost may be worth it, but I think that's true for a much smaller segment than a lot of people who argue the point. I suspect this is because my paycheck depends on keeping the business running smoothly, not selling security consulting services.

AnIdiotOnTheNet 8y ago

> An attacker that gains SYSTEM permissions on a machine can dump the SAM database, which may contain credentials for domain or enterprise administrators. This is very bad. True enough, but unlikely to be a significant risk. If you are concerned about it then it is much easier to have a separate AD account that only has local administrator on normal (non-admin) workstations and use that. > A user with administrator permissions can modify their DNS settings to avoid DNS-level filtering to block known malware domains. This can be bad. It is trivial to block or even reroute DNS queries to unapproved servers at the firewall. At least until DNS over HTTPS ruins that and simultaneously renders your point moot. > A malicious or ignorant user can disable or remove antivirus protection. This can be bad. I disagree. Anti-virus software has negative value and always causes significantly more trouble than it is worth. Case in point, the very issue we're talking about. > A user can accidentally make a computer nonfunctional by, for example, deleting system files, perhaps because it was suggested (sarcastically) on a help forum ("LOL delete system32"). This is bad. This is a minor inconvenience at best, that's what imaging is for. > I'm far from a security expert, but from a sysadmin perspective, every user having local admin privs is an absolute nightmare. If it were a nightmare, I'd have expected to see more issues arise from it throughout my career, but I've yet to see even one instance where a user having local admin has caused any significant trouble.

KAMSPioneer 8y ago
> True enough, but unlikely to be a significant risk. If you are concerned about it then it is much easier to have a separate AD account that only has local administrator on normal (non-admin) workstations and use that. I strongly disagree. If an attacker gains access to a system as an admin user, that is a much larger problem than a non-admin user. Designing an environment as you suggested helps compartmentalize that, but it doesn't help the fact that a SAM database from one of those machines can potentially spell an almost company-wide compromise. Such a strategy gives far too much opportunity for lateral movement in case of a single compromised machine. > It is trivial to block or even reroute DNS queries to unapproved servers at the firewall. That's a good point. >I disagree. Anti-virus software has negative value and always causes significantly more trouble than it is worth. Case in point, the very issue we're talking about. Regardless of your feelings on antivirus (I'm ambivalent myself), I don't quite see how a potential abuse of an antivirus software, which can lead to EoP, is justification for allowing all users in an enterprise to have full local admin privileges. You're cutting out the step where an attacker has to exploit an EoP vulnerability. > This is a minor inconvenience at best, that's what imaging is for. True, but if I can avoid the trouble by limiting user privileges, why not? > If it were a nightmare, I'd have expected to see more issues arise from it throughout my career, but I've yet to see even one instance where a user having local admin has caused any significant trouble. It's possible it may never be a problem in $arbitraryEnvironment, but that doesn't make it good security practices. I can imagine that in smaller environments, it may even be somewhat manageable. There will probably be circumstances that create a need for local admin access as you described, but I don't think it should be the modus operandi.
- AnIdiotOnTheNet 8y ago
  > I strongly disagree. If an attacker gains access to a system as an admin user, that is a much larger problem than a non-admin user. Not really. There's quite a lot you can do as a non-admin user too you know. You can probe anything on the internal network that machine has access to and act as a relay for the attacker, for instance. Since the user does work for the company, they probably already have access to a lot of things the organization would rather not give out. Local admin gives you a few more options, but the difference isn't really worth special attention in my book. > True, but if I can avoid the trouble by limiting user privileges, why not? Because you're also causing a lot of friction for the users. Users do work too you know, in aggregate hopefully a lot more than sysadmins. Every barrier you put between them and their work is a cost, and my argument is that the cost of locking everyone out of local admin pretty much always outweighs the benefits. > I don't quite see how a potential abuse of an antivirus software, which can lead to EoP, is justification for allowing all users in an enterprise to have full local admin privileges. It isn't, it's justification for disregarding "could disable the virus scanner" as a valid reason for denying local admin to the user. "Good security practice" is often, in my experience, either a lot of academic crap that completely ignores the concept of risk analysis, or what someone who's trying to sell you something recommends. Every barrier you put between people and their ability to do work for the company is a cost that you have to justify against the cost of a compromise and the probability of said compromise actually occurring. Depending on your environment, that level of cost may be worth it, but I think that's true for a much smaller segment than a lot of people who argue the point. I suspect this is because my paycheck depends on keeping the business running smoothly, not selling security consulting services.