User Account Administration

In this chapter, we will cover the concepts and technologies that enable the secure and productive use of the Windows 11 operating system, as well as the advanced options available to secure the user account credentials and prevent unauthorized system configuration changes and software installation.

We will explore the following topics:

• Windows account types
• Account privileges
• Local Administrator Password Solution
• Creating policies to control local accounts
• Managing user sign-in options
• User Account Control
• Privileged Access Workstation

Windows account types

The Windows 11 operating system supports five types of accounts, each used to enable different functionalities:

• Service account: These accounts are used to run background services and are assigned specific permissions. They are not used to log in to the system but may be used remotely. Domain-joined computers may have additional service accounts assigned to enable central administration.
• Local user account: By default, at least one local user account is created to run as the local administrator when first configuring the operating system. Depending on how Windows is installed, this account may be a generic account, such as an administrator, or it could be named after the first user who completes the first-time run wizard and chooses not to register a Microsoft account. These accounts are governed by the local password policies, which can be configured via Group Policy or a device/application management service such as Microsoft Intune.
• Microsoft...

Account privileges

Each account can be assigned a range of specific privileges, from a standard user account (with no systems access) to a full local administrator account. Gaining access to administrative rights on the Windows operating system is one of the key attack vectors that needs to be prevented in every organization and even on personal PCs. Administrative rights are required when changing configurations or installing software, both of which should not be carried out by users, and therefore all user accounts should be restricted to standard user accounts only.

Where there is a genuine need for a user to be granted local admin rights on a computer, they should never be assigned to the user’s main account that they use for gaining access to email, documents, and websites. This leads to the potential for a user to open a document, or click on a hyperlink, that contains malware. A better design approach is to create a local user account specific to this user and provide...

Local Administrator Password Solution

If a single password is configured for the local admin accounts across all domain-joined computers, there is a high risk that it can be used in a widespread attack to install malware, elevate privileges, or gain access to sensitive files. To resolve this issue, Microsoft offers the Local Administrator Password Solution (LAPS). This works by setting a different random password on every computer in the domain and storing that password in AD, or Azure AD if it is used. Administrators can choose who can access those passwords in order to support the PCs.

The solution is built into AD and doesn’t require any other supporting technologies or licenses. LAPS uses the Group Policy client-side extension (CSE) or CSP that you install on managed computers to perform all management tasks. The solution’s management tools provide easy configuration and administration.

Once configured, you can create Group Policy settings to enable local administrator...

Creating policies to control local accounts

If you enable local admin accounts, for users who require them, you should also enforce a set of policies to ensure the local accounts have strong authentication standards. On domain-joined computers, Group Policy can be used to specify the settings of the local account policy, which contains two subsets:

• Password policy: These policy settings determine the controls for local account passwords, such as enforcement and lifetimes
• Account lockout policy: These policy settings determine the circumstances and length of time for which an account will be locked out of the system when the password is entered incorrectly

Password policy

The password policy enforces specific values that control how often the password is changed, how complex it is, and whether users can reuse old passwords. The default values are shown in the following screenshot:

Figure 4.2 – Local Security Policy’s password...

Managing user sign-in options

Windows 11 Enterprise offers a range of configurable options to manage the account logon process. Some of the features are designed to increase security, while others are to improve the user experience. It’s worth mentioning that with Multifactor Authentication in use, the password strength for a user is less of a bulwark for enterprise security.

The following settings can be configured via GPO to ensure a consistent approach across all domain-joined computers:

• Turn on convenience PIN: This setting should be disabled as it causes the password to be cached in the system vault; instead, use the Hello for Business feature that we will see later in this chapter.
• Turn off picture password sign-in: This policy should be enabled to prevent the use of this feature. Picture password sign-in enables the user to sign in with a unique gesture based on their picture, but also causes the user’s password to be cached in the system vault....

Mobile device management security settings

If you are managing your computers with a mobile device management (MDM) solution such as Microsoft Intune, you have the following security settings available:

• Required password type: Specifies the type of password that’s required, such as alphanumeric or numeric only.
• Required password type - minimum number of character sets: Specifies how many different character sets must be included in the password. There are four character sets: lowercase letters, uppercase letters, numbers, and symbols. However, for iOS devices, this setting specifies the number of symbols that must be included in the password.
• Minimum password length: Configures the minimum required length (in characters) for the password.
• Number of repeated sign-in failures to allow before the device is wiped: Wipes the device if the sign-in attempts fail this number of times.
• Minutes of inactivity before screen turns off: Specifies the number of minutes...

User Account Control

User Account Control (UAC) is a fundamental security control that helps mitigate the impact of malware, yet some enterprise administrators disable UAC at the request of the users because it is seen as an annoying and unnecessary prompt that gets in the way of productivity. The feature has improved greatly since it was first launched (as part of Windows Vista), so we encourage you to ensure this is enabled across all managed computers in your environment. Microsoft tests all software with the defaults enabled, therefore disabling UAC may cause unexpected results for application launches or security configurations.

With UAC enabled, Windows 11 prompts for consent, or for credentials of a valid local administrator account, before starting a program or task that requires a full administrator access token. This prompt ensures that no malicious software can be silently installed.

If the user is logged on with local admin rights (which is not recommended), the consent...

Privileged Access Workstation

If you really want to take security seriously, then you need to provide the highest levels of security for your privileged accounts to prevent malicious behavior through compromised access. Microsoft has developed a complete set of guidance materials on how to configure specific workstations used by administrators and other privileged accounts to carry out sensitive tasks, such as systems administration and high-value financial transactions.

In this model, the computers are designated specifically for privileged access, blocking any other accounts from logging on interactively or via the network. Instead of logging on to the computer as a standard user and elevating privileges to gain access to sensitive information and systems, the user logs onto the PAW computer directly with the privileged account and carries out the tasks required.

This system works by preventing the usual risky behaviors such as internet browsing, opening emails and attachments...

Summary

Windows 11 Enterprise provides the tools required to deliver a secure environment to access sensitive and valuable information and systems.

There are many options to consider when creating and securing local user accounts that will gain authorized access to your systems. The most important rule is to never log in to computers with local admin rights enabled, and to instead use run-as to elevate rights with a separate administrative account. Also, never log in to a client computer with domain-privileged accounts, and limit logging on to trusted IT PCs only, such as PAWs. Finally, ensure all administrative account passwords are unique across computers, complex, and changed regularly.

In the next chapter, we will explore remote administration for troubleshooting and remote assistance.