Small Town Sysadmin
Free CJIS checklist

Active Directory

Separate admin accounts and the Protected Users group, for small shops

Why your everyday login shouldn't be a Domain Admin, how to split admin accounts without a big project, and how to use Protected Users without locking yourself out.

In small shops, it’s common for the IT person’s everyday account, the one used for email and web browsing, to also be a Domain Admin. It’s convenient. It’s also exactly what attackers hope for: one phishing click or one malicious download running under that account can hand over the whole domain.

The fix doesn’t require new software. It takes two accounts and one built-in group.

Step 1: Split your daily account from your admin account

Give every person who administers the domain two accounts:

  • A daily account (for example, jsmith) for email, web, documents, and everything else. No admin rights.
  • An admin account (for example, adm-jsmith) used only for administrative work: managing Active Directory, servers, and domain controllers. Never used for email or web browsing.

A few habits make it work:

  • Log in with the admin account only where it’s needed, such as on a server or a dedicated admin workstation, not on the PC you read email on.
  • Keep Domain Admins small. Only the admin accounts that truly need it. Review membership regularly with the command in Everyday Active Directory PowerShell commands.
  • Protect the admin accounts with MFA wherever your tools support it.
  • Keep one “break-glass” admin account with a long, unique password stored safely offline, for emergencies. Don’t use it day to day.

Step 2: Add admin accounts to Protected Users

Protected Users is a built-in Active Directory group that applies stricter sign-in protections to its members automatically. According to Microsoft, members of the group:

  • Can’t sign in with NTLM, an older authentication method commonly abused in “pass-the-hash” attacks. They must use Kerberos.
  • Can’t use weak Kerberos encryption (DES or RC4), only AES.
  • Can’t be delegated, so a compromised service can’t impersonate them elsewhere on the network.
  • Get shorter Kerberos tickets, four hours by default, so stolen tickets expire sooner.
  • Don’t have their credentials cached on the machines they sign in to.

These protections are what make Protected Users valuable for admin accounts. They’re also what can break things.

Don’t lock yourself out

Microsoft’s own support forums are full of admins who added every Domain Admin to Protected Users at once and immediately lost access to systems. Avoid that:

  • Never add service accounts or computer accounts. Many depend on exactly what the group blocks.
  • Add one admin account first, then test everything that account does: logging in to servers, remote desktop, management consoles, and any application that authenticates with it.
  • Watch for NTLM-only paths. For example, connecting to a server by IP address instead of by name typically falls back to NTLM, which will fail for members.
  • Keep your break-glass account out of the group, so you have a way in if something goes wrong.
  • Check your domain controllers. The full set of protections needs domain controllers running Windows Server 2012 R2 or later, with the domain functional level at 2012 R2 or higher.

Once one account works cleanly for a week or two, add the rest of your admin accounts one at a time.

Sources

All articles