Admin rights

Question

Hi all

An administrator credential is to take control of a workstation in the unsecure tiers and expect that an administrator will connect to it.

An attack such as credential theft or kerberos delegation is then performed.

To reduce the impact of such compromise, the best practice is to isolate components (such as admins, DC) in tiers.

Typically, a domain admin should not be allowed to connect to any workstation but login only to perform highly privileged operations.

How would you prevent highly privileged admins (Tier 0) from accessing non-privileged resources?

How will admins access non-privileged resources?

Answer 1

if this is the case without any GPO

you need to configure the local security policy at each workstation

maybe you can use a PowerShell script like the following

please do not use the powershell directly modify according to your requirements

$DomainAdminGroup = "YourDomain\Domain Admins"

$Workstations = Get-ADComputer -Filter 'OperatingSystem -like "*Windows*" -and OperatingSystem -notlike "*Server*"'

foreach ($Workstation in $Workstations) {
    $ComputerName = $Workstation.Name

    Invoke-Command -ComputerName $ComputerName -ScriptBlock {
        param($DomainAdminGroup)

        $LocalPolicyPath = "HKLM:\System\CurrentControlSet\Control\Lsa\"

        $LogonRights = Get-ItemProperty -Path $LocalPolicyPath -Name "SeDenyInteractiveLogonRight"
        $RemoteLogonRights = Get-ItemProperty -Path $LocalPolicyPath -Name "SeDenyRemoteInteractiveLogonRight"

        $LogonRightsArray = $LogonRights.SeDenyInteractiveLogonRight
        $RemoteLogonRightsArray = $RemoteLogonRights.SeDenyRemoteInteractiveLogonRight

        if (-not $LogonRightsArray.Contains($DomainAdminGroup)) {
            $LogonRightsArray += $DomainAdminGroup
            Set-ItemProperty -Path $LocalPolicyPath -Name "SeDenyInteractiveLogonRight" -Value $LogonRightsArray
        }

        if (-not $RemoteLogonRightsArray.Contains($DomainAdminGroup)) {
            $RemoteLogonRightsArray += $DomainAdminGroup
            Set-ItemProperty -Path $LocalPolicyPath -Name "SeDenyRemoteInteractiveLogonRight" -Value $RemoteLogonRightsArray
        }
    } -ArgumentList $DomainAdminGroup
}