Chapter 12 — Operating systems
Lesson map
Lesson 12 published. Map, example, EX034.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Local accounts"]
N2["12.2 Privilege on endpoints"]
N3["12.3 Device sign-in and central identity"]
N4["12.4 Service accounts on hosts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX034"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Local accounts"]
N2["12.2 Privilege on endpoints"]
N3["12.3 Device sign-in and central identity"]
N4["12.4 Service accounts on hosts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX034"]
[Learning outcomes]
|
v
[12.1 Local accounts]
|
v
[12.2 Privilege on endpoints]
|
v
[12.3 Device sign-in and central identity]
|
v
[12.4 Service accounts on hosts]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX034]
Learning outcomes
You will (1) explain local accounts and privileges on hosts; (2) relate device sign-in to central identity; (3) protect administrator rights on endpoints.
12.1 Local accounts
Every laptop and server has local accounts managed by its operating system, alongside any central directory accounts. Local administrator accounts are powerful and often share the same password across many machines when built from one image. If one machine's local password is discovered, all others become exposed. Sana recommends unique, automatically rotated local administrator passwords stored centrally with access logged, so each machine's local account is different and its use is visible. Use of a local administrator account then becomes a rare, visible event that monitoring can flag, rather than routine background activity that hides misuse among normal work.
12.2 Privilege on endpoints
Operating systems separate ordinary users from administrators. Staff who work daily as administrators can install software and change security settings, which means any malicious file they open gains the same power. Least privilege on endpoints means staff use standard accounts, with elevation granted only when needed and logged. At Linmouth, about a third of staff hold local administrator rights for historical reasons; Sana proposes removing them in stages, with a request process for genuine needs such as specialist software installation.
12.3 Device sign-in and central identity
When staff sign in to a council laptop, the operating system can verify them against the central directory or identity provider, and may unlock a device-bound key that later serves as a passkey. Joining devices to central identity means a disabled account can no longer sign in to any council device. It also allows device health, such as encryption and updates, to inform access decisions. Sana maps which device types are joined, which are not, and what that means for leavers.
12.4 Service accounts on hosts
Services on servers often run under dedicated accounts. These accounts are rarely reviewed, frequently over-privileged and sometimes hold passwords that never change. Sana inventories service accounts on a sample of servers, recording owner, purpose, privileges and how credentials are managed. Where possible, she recommends managed service identities whose credentials rotate automatically. Service accounts are part of identity and access management too, and attackers often look for them precisely because organisations forget them. Each service account also gets a review date, so it is checked along with human accounts rather than forgotten.
Worked example
A synthetic server sample shows 14 service accounts, 5 without a named owner and 3 with passwords unchanged for over two years; Sana records them as findings.
Synthetic case. Servers and accounts are synthetic.
Errors and limits
Building every laptop from one image with the same local administrator password exposes all machines when one is compromised.
Exercises
- EX034 — Shared local password. Why is one shared local administrator password dangerous? Rubric: 3 = exposure of one machine exposes all;; 2 = all machines;; 1 = speed;; 0 = none.
- EX035 — Endpoint least privilege. How does Sana apply least privilege to staff laptops? Rubric: 3 = standard accounts, logged elevation on request;; 2 = standard accounts;; 1 = all admin;; 0 = none.
- EX036 — Ownerless service accounts. How many service accounts lack a named owner in the sample? Rubric: 3 = 5 of 14;; 2 = 5;; 1 = 14;; 0 = none.
Synthesis
Unique local credentials, least privilege on endpoints, central device sign-in and reviewed service accounts extend IAM to every host.
Continue studying — chapter 12 of 50
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →