User Account Administration

In this chapter, we will cover the concepts and technologies that enable the secure and productive use of the Windows 10 operating system as well as the advanced options available to secure the user account credentials and prevent unauthorized system configuration changes and software installation.

We will explore the following topics:

• Windows account types
• Account privileges
• Local Administrator Password Solution
• Creating policies to control local accounts
• Managing user sign in options
• Exploring security settings available with Mobile device management (MDM)
• User Account Control
• Windows Hello for Business
• Credential Guard
• Privileged Access Workstation

Windows account types

The Windows 10 operating system supports five types of accounts, each used to enable different functionality:

• System account: These accounts are used to run background services and are assigned specific permissions. They are not used to log in to the system, but may be used remotely. Domain-joined computers may have additional service accounts assigned to enable central administration.
• Local user account: By default, at least one local user account is created to run as the local administrator when first configuring the operating system. Depending on how Windows is installed, this account may be a generic account, such as administrator, or it could be named after the first user that completes the first-time run wizard and they choose not to register a Microsoft account. These accounts are governed by the local password policies, which can be configured via...

Account privileges

Each account can be assigned a range of specific privileges, from a standard user account (with no systems access) to a full local administrator account. Gaining access to administrative rights on the Windows operating system is one of the key attack vectors that needs to be prevented in every organization, and even personal PCs. Administrative rights are required when changing configurations or installing software, both of which should not be carried out by users, and therefore all user accounts should be restricted to standard user accounts only.

Where there is genuine need for a user to be granted local admin rights on a computer, they should never be assigned to the user's main account that they use for gaining access to email, documents, and websites. This leads to the potential for a user to open a document, or click on a hyperlink, that contains...

Local Admin Password Solution

If a single password is configured for the local admin accounts across all domain-joined computers, there is a high risk that it can be used in a widespread attack to install malware, elevate privileges, or gain access to sensitive files. To resolve this issue, Microsoft offers the Local Admin Password Solution (LAPS). This works by setting a different random password on every computer in the domain and storing that password in AD. Administrators can choose who can access those passwords in order to support the PCs.

The solution is built into AD and doesn't require any other supporting technologies or licenses. LAPS uses the Group Policy client-side extension (CSE) that you install on managed computers to perform all management tasks. The solution's management tools provide easy configuration and administration.

Once configured, you can...

Create policies to control local accounts

If you enable local admin accounts, for users that require them, you should also enforce a set of policies to ensure the local accounts have strong authentication standards. On domain joined computers, Group Policy can be used to specify the settings of the local account policy, which contains two subsets:

• Password Policy: These policy settings determine the controls for local account passwords, such as enforcement and lifetimes
• Account Lockout Policy: These policy settings determine the circumstances and length of time for which an account will be locked out of the system when the password is entered incorrectly

Password policy

The password policy enforces specific values that control...

Manage user sign in options

Windows 10 Enterprise offers a range of configurable options to manage the account logon process. Some of the features are designed to increase security, others are to improve the user experience.

The following settings can be configured via GPO to ensure a consistent approach across all domain-joined computers:

Setting name	Description
Turn on convenience PIN	This setting should be disabled as it causes the password to be cached in the system vault; instead, use the Hello for Business feature, which we will see later in this chapter.
Turn off picture password sign in	This policy should be enabled to prevent the use of this feature. Picture password sign in enables the user to sign in with a unique gesture based on their picture, but also causes the user's password to be cached in the system vault. Windows Hello for Business is...

Mobile device management security settings 

If you are managing your computers with an Mobile device management (MDM) solution, such as Microsoft Intune, you have the following security settings available:

Setting name	Details
Required password type	Specifies the type of password that's required, such as alphanumeric or numeric only.
Required password type - Minimum number of character sets	Specifies how many different character sets must be included in the password. There are four character sets: lowercase letters, uppercase letters, numbers, and symbols. However, for iOS devices, this setting specifies the number of symbols that must be included in the password.
Minimum password length	Configures the minimum required length (in characters) for the password.
Number of repeated sign in failures to allow before the device is wiped	Wipes the...

User Account Control

UAC is a fundamental security control that helps mitigate the impact of malware, yet some enterprise administrators disable User Account Control (UAC) at the request of the users, because it is seen as annoying and unnecessary prompts that get in the way of productivity. The feature has improved greatly since it was first launched (as part of Windows Vista), so we encourage you to ensure this is enabled across all managed computers in your environment.

With UAC enabled, Windows 10 prompts for consent, or prompts for credentials of a valid local administrator account, before starting a program or task that requires a full administrator access token. This prompt ensures that no malicious software can be silently installed.

If the user is logged on with local admin rights (which is not recommended), the consent prompt is presented when a user attempts to perform...

Windows Hello for Business

Passwords are renowned as one of the main causes for weak security in most computer systems. Passwords may be reused across multiple systems (including social networks and weak websites), they may be created based on guessable information that can be socially engineered or cracked using specialized software, or most likely stored in a database that is then compromised and shared across the cyber criminal community. So no matter how well we educate users to create more complex passwords that are changed frequently, there is always going to be a risk of compromise of the password, which can then be used to gain access to systems, impersonating a valid user.

The best defense against this type of risk is to deploy multi-factor authentication (MFA) mechanisms: a method of authentication that requires the user to provide more than just a password to gain...

Credential Guard

Credential Guard is unique to Windows 10 Enterprise and Windows Server 2016, and designed to protect against OS-level attempts to read credentials. It uses hardware and virtualization-based security to isolate secrets so that only privileged system software can access them. Credential Guard protects NTLM password hashes, Kerberos Ticket-Granting Tickets, and credentials stored by applications.

Usually, Windows stores secrets in the Local Security Authority (LSA), in process memory. With Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. You can consider the isolated LSA as running like a small virtual machine...

Privileged Access Workstation

If you really want to take security seriously, then you need to provide the highest levels of security for your privileged accounts, to prevent malicious behavior through compromised access. Microsoft has developed a complete set of guidance material on how to configure specific workstations used by administrators, and other privileged accounts, to carry out sensitive tasks such as systems administration and high-value financial transactions.

In this model, the computers are designated specifically for privileged access, blocking any other accounts from logging on interactively or via the network. Instead of logging on to the computer as a standard user and elevating privileges to gain access to sensitive information and systems, the user logs onto the PAW computer directly with the privileged account and carries out the tasks required.

This system...

Summary

Windows 10 Enterprise provides the tools required to provide a secure environment to access sensitive and valuable information and systems.

There are many options to consider when creating and securing local user accounts that will gain authorized access to your systems. The most important factors are:

• Never log in to computers with local admin rights enabled, use run-as to elevate rights with a separate administrative account
• Never log in to a client computer with domain-privileged accounts, limit logging on to trusted IT PCs only, such as PAW
• Ensure all administrative account passwords are unique across computers, complex, and changed regularly

In the next chapter, we will explore remote administration for troubleshooting and remote assistance.