Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

Question

There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc.

The only requirement for administrative access within our estate would be to install or update software; with most software deployed centrally through SCCM. As such, any requirement would be an IT service desk agent or field technician making ad-hoc changes to a machine, or possibly a developer. There are no requirements for standard users to be local machine administrators.

In the process of creating a reasonable POLP (Principle of least Privilege) policy, we determined that all users should have standard desktop user accounts, and secondary administrative accounts; with the intention being that any requirement to make local changes will be challenged with a UAC, requiring different credentials.

Not only will this stop any malicious processes running in their environment from executing using their account privileges, it also acts as a 'psychological fireguard' to ensure they are being made aware they are making local changes. Additionally, should their standard account be compromised (they have emails, for example), the compromised accounts are not Administrative.

Now, the above seemed logical to me at first glance, but a colleague has since challenged the proposal.

I respect the colleague immensely and he has many, many years of experience in IT; but his challenge was that his standard account has Local administrative privileges on his own machine, and that with UAC turned on this should be sufficiently protected.

Is he Right?

Some of the users would need their ADM accounts linked to a group that populates local administrators to all machines on the domain; putting their standard accounts into that membership seems like a huge risk to me, but is simply enabling UAC prompts sufficient?

Answer 1

In the context of your question, there is no real "right or wrong" answer because we don't really know what are your security requirements.

First, you should take into account the fact that UAC is by no mean the same thing as not having admin privilege. I suggest you read this answer: it contains pretty much all the details you need to know about what UAC is and, more important, what it isn't but the most crucial point is that UAC is only a protection against "low hanging fruits" type of attacks.

That doesn't mean your colleague is wrong either: it might be that, for the set of tasks your users routinely have to perform and for the kind of threat environment you're working in, UAC might be deemed good enough.