◇ OpenCyber Academy
Technical · Chapter 3 · English

Chapter 3 — Windows accounts and rights

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Windows accounts and rights

Lesson map

Lesson 03 published. Map, example, EX009.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Two kinds of account"]
  N2["3.2 Separate admin accounts"]
  N3["3.3 User Account Control"]
  N4["Lab — Finding extra administrators"]
  N5["3.4 Reading the result"]
  N6["Leftover accounts"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX009"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Two kinds of account"]
  N2["3.2 Separate admin accounts"]
  N3["3.3 User Account Control"]
  N4["Lab — Finding extra administrators"]
  N5["3.4 Reading the result"]
  N6["Leftover accounts"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX009"]

[Learning outcomes]
    |
    v
[3.1 Two kinds of account]
    |
    v
[3.2 Separate admin accounts]
    |
    v
[3.3 User Account Control]
    |
    v
[Lab — Finding extra administrators]
    |
    v
[3.4 Reading the result]
    |
    v
[Leftover accounts]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX009]

Learning outcomes

You will (1) explain standard and administrator accounts; (2) use separate admin accounts; (3) understand UAC.

3.1 Two kinds of account

Windows accounts are either standard users or administrators. Standard users run programs and save their own work. Administrators can install software, change settings and read any file. At Harlow & Pike, staff were given admin rights years ago so they could install printer drivers, and nobody took them away. Admin rights mean any program a staff member runs, including a malicious attachment, can do the same. Nadia's checks later show how widespread the problem is, which shapes her project. She lists each extra administrator account by PC and user, which becomes the starting list for her project.

3.2 Separate admin accounts

The IT supplier and Nadia use separate accounts for admin work. Day-to-day email and browsing happen in a standard account, so a malicious email attachment opened by mistake runs without admin rights. This is the principle of least privilege described by Saltzer and Schroeder in 1975. At Harlow & Pike, the supplier's staff had been doing admin work from their everyday accounts. Nadia shows Lena how separate accounts reduce what an attack through email could do, and the supplier agrees to change its practice. Admin accounts are not used for email or browsing.

3.3 User Account Control

User Account Control, or UAC, asks for confirmation or credentials before a program gets admin rights. For a standard user, UAC asks for an admin password, which they do not have, so the installation stops. For an administrator, UAC only asks for a click, which people approve without thinking. This is why removing admin rights from staff matters at the firm: with admin rights, UAC becomes a click that people approve without reading, including for software from download sites. As standard users, staff cannot install software by accident.

Lab — Finding extra administrators

"""List PCs where users other than the IT admin account hold local admin rights (synthetic, stdlib only)."""
pcs = {"PC01": ["itadmin"], "PC02": ["itadmin", "j.hale"], "PC03": ["itadmin"], "PC04": ["itadmin", "r.cole", "temp"],
       "PC05": ["itadmin"], "PC06": ["itadmin", "s.iqbal"], "PC07": ["itadmin"], "PC08": ["itadmin"],
       "PC09": ["itadmin", "m.fry"], "PC10": ["itadmin"]}
extra = {pc: [u for u in us if u != "itadmin"] for pc, us in pcs.items() if len(us) > 1}
for pc, us in extra.items(): print(f"{pc} extra admins: {', '.join(us)}")
print(f"PCs with extra admins: {len(extra)} of {len(pcs)}; extra accounts: {sum(len(v) for v in extra.values())}")

Run with python3 lab_admins.py. Verified output:

PC02 extra admins: j.hale
PC04 extra admins: r.cole, temp
PC06 extra admins: s.iqbal
PC09 extra admins: m.fry
PCs with extra admins: 4 of 10; extra accounts: 5

3.4 Reading the result

In a sample of ten PCs, four have extra administrators, five accounts in total, including a leftover account called temp. Each must be checked with the user and removed, with an alternative way to get software they need. Each extra administrator is a decision someone made years ago and never reviewed. The temp account is the most concerning, because nobody knows who uses it. Nadia lists the accounts with the PCs and users, and Lena agrees to remove them once each user has another way to install the software they need.

Leftover accounts

The temp account found on PC04 was created years ago for a contractor and never removed. Leftover local accounts like this are easy to forget: they do not appear in the directory, nobody signs in with them and their passwords are often weak or shared. Because temp was also an administrator, anyone who knew its password could take full control of the PC. Removing its admin rights is not enough; the account itself is deleted after checking that no files or scheduled tasks depend on it. Nadia adds a check for unexpected local accounts to the quarterly routine, using the same export as the admin rights lab.

Worked example

Lena approves removing the extra rights; the supplier sets up a self-service software list so staff can install approved tools without admin rights.

Synthetic case. Accounts are synthetic.

Errors and limits

Removing admin rights without offering an alternative leads to frustration and requests to restore them.

Exercises

Synthesis

Standard accounts for daily work limit the damage of mistakes and malicious files.

Continue studying — chapter 03 of 18

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →