4 ms·
> create another Admin account and transform your current one to limited/ restricted/ standard user account to reduce the attack surface enormously. Don't use
by pid-1 4y ago
> create another Admin account and transform your current one to limited/ restricted/ standard user account to reduce the attack surface enormously. Don't use Admin account for your tasks!
It's crazy how Windows doesn't have a sane way for users to became administrators temporarily. LAPS is a weird hack and Azure PIM doesn't work for local admin.
- kevingadd 4y agoThere's a 'run as' mechanism built in and accessible via GUI inside of Task Manager (File -> Run New Task) and the command prompt ('runas'). You can also open an Administrator Command Prompt.
- glowingly 4y agoAt work, we have an applied policy that shows an elevated prompt for most things that need admin permissions. It's apparently one of those hidden UAC settings that either needs GPO or regedit to enable. So it's there, just not really exposed to end users.
- oritsnile 4y agoIt's crazy, if you don't separate your admin account, the UAC prompt can be bypassed due to the default settings.
- BrandoElFollito 4y ago> enormously [citation needed] https://xkcd.com/1200/ https://xkcd.com/1200/ What is the valuable thing for an attacker? User data, credentials? Available as a user Computer capacities for mining? Available as a user Installing persistence? Available as a user Installing remote management? Available as a user