What does restricting admin privileges mean?
Where it stops an attack.
- The attack A staff member’s everyday account is phished.
- Stopped here That account has no admin rights. Admin work needs a separate account that can’t read email.
- The result The attacker can’t switch off security tools or delete backups.
Admin privilege maturity levels
What changes at each level.
What changes ML1 Maturity Level 1. ML2 Maturity Level 2. ML3 Maturity Level 3.
Granting access Checked when first requestedAdds: removed after 12 months unless revalidated, and after 45 days unusedAdds: limited to what each duty needs
Admin accounts Separate accounts, blocked from email and the web unless authorised No change
No change
Where admin work happens A separate admin environmentAdds jump servers. Admin environment never a virtual machine inside a standard oneAdds Secure Admin Workstations and just-in-time access
Break glass, local admin and service account passwords Not required
Long, unique and managed No change
Credential protection Not required
Not required
Credential Guard, Remote Credential Guard, LSA protection and memory integrity on
Logging Not required
Admin sign-ins and account changes logged centrally. Internet-facing server logs analysedAdds analysis of workstation and internal server logs
Each level includes everything in the one before. A plain-English summary, not the requirement text. ASD Essential Eight Maturity Model (November 2023)
How to restrict admin privileges
Protection first, disruption last.
- 01
List every admin account
Microsoft 365, servers, devices, firewalls and line-of-business apps. Most businesses find more than they expected. - 02
Separate everyday and admin accounts
A standard account for email, a separate one for admin work. - 03
Remove standing local admin
Staff don’t need admin on their laptops. LAPS randomises local admin passwords. - 04
Review on a schedule
Revalidate access at least yearly and switch off accounts that go unused.
Common admin privilege mistakes
Where rollouts go wrong.
-
The owner as global admin
Directors often keep admin rights “just in case”, and they’re prime phishing targets.
-
Shared admin accounts
One password, three people, no record of who did what.
-
Forgetting cloud admins
Microsoft 365, accounting and practice platforms have admin roles too.
Should the business owner have admin access?
Usually not day to day. If an owner needs admin rights, they use a separate account with phishing-resistant MFA, only when needed.
Do staff need admin rights to install software?
No. A managed software portal lets staff install approved apps without admin rights.
What is just-in-time administration?
Admin rights granted for a limited time when needed, then removed automatically, so there are no standing admin accounts to steal. It’s a Maturity Level 3 requirement.