Reduce Access to Windows Local Administrator With Endpoint Privilege Management

Analysis

• Risks Associated With Local Admin Rights
  • Local Admin Rights Are Powerful
  • The Endpoint Is a Common Attack Vector
  • Malware Needs Administrative Privilege
  • Local Admin Rights Are Often Poorly Managed
  • Nonmalicious Actors May Misuse Administrative Privilege
• Evolution of Local Admin Access in Windows
• Why Does the Use of Local Admin Rights Persist?
  • Some Applications and Processes Still Require Administrative Privilege
  • User Controlled and Lightly Managed Endpoints Require Administrative Privilege
  • Political or Cultural Barriers to Removing Local Admin Rights
• Are Local Admin Rights Necessary in a Modern Windows Environment?
• EPM Overview
  • Application Control
  • Privilege Management
• EPM Architecture
  • EPM Policy Management Service
  • EPM Agent
• EPM Features Inherent in Microsoft Windows
  • UAC
  • AppLocker
  • PAM
  • LAPS
  • Credential Guard
• EPM Market Overview
• Microsoft Windows EPM vs. Third-Party EPM Tools
• EPM and Privileged Account and Session Management Working Together to Secure Privileged Operations
• Strengths
• Weaknesses

Guidance

• Use the Migration to Windows 10 as a Catalyst for the Removal of Local Admin Rights
• Enable UAC and LAPS, at a Minimum
• Architect a Combined Privilege Management and Application Control Strategy to Contain Attacks at the Endpoint
• Build a Process for Exception Handling
• Tamper Proof Your EPM Environment

Gartner Recommended Reading