4.1 User Accounts, Admin Rights, and Least Privilege
The Privilege Pyramid
Every OS stacks accounts by privilege: root and the built-in Administrator sit at the apex, service accounts run daemons, standard users do daily work, and guest gets almost nothing. The Principle of Least Privilege (PoLP) draws a hard ceiling under the elevation layer: your daily login must never carry admin rights. Give each person two accounts, a standard one for browsing and mail, and an admin account used only when an elevation prompt appears. List current members with net localgroup Administrators on Windows or getent group sudo on Linux, and remove anyone who does not need elevation.
Windows: UAC and Token Filtering
User Account Control works by token splitting. When a member of the Administrators group signs in, Windows builds two access tokens: the full privileged token stays dormant, and a filtered standard token runs every process by default. Launching an elevated app triggers a consent or credential prompt on the secure desktop, then re-attaches the full token with a new process ID for audit. Admin Approval Mode is the default for the first interactive admin; built-in Administrator bypasses the prompt, which is why Microsoft recommends keeping it disabled. Set the UAC slider to "Always notify" so elevation always interrupts you, and treat any unprompted elevation as an incident.
Linux: sudo and Service Accounts
On Linux, root does administration and nobody logs in as root directly; disable PermitRootLogin in sshd_config. Users elevate per command with sudo, which consults /etc/sudoers through visudo -- never edit that file with a plain editor, since one syntax error can lock out every admin. Prefer narrow grants like deploy ALL=(ALL) /usr/bin/systemctl restart nginx over ALL=(ALL) ALL. Daemons should run as dedicated accounts such as www-data or mysql, created with useradd -r -s /usr/sbin/nologin so they cannot open interactive shells.
Auditing Privilege Creep
Privilege creeps upward quietly, so audit it on a schedule. Re-run group membership checks monthly, review sudo -l per user, and watch the Windows Security event log for Event ID 4732 ("A member was added to a security-enabled local group"). Alert on new accounts, not just new admins: a fresh local account dropped into the Administrators group is a classic persistence move. Rotate shared admin credentials and retire any grant nobody can justify in writing.
Architecture Diagram
Key Takeaways
- PoLP means every account, service, and process gets the minimum rights needed for its job.
- UAC splits an admin's token into filtered and full copies; the filtered one runs everything by default.
- Use
visudofor sudoers edits and scope grants to specific commands, not blanket ALL. - Service accounts should be non-interactive (
-s /usr/sbin/nologin) and own only their service's files. - Audit group membership on a schedule; new local admins (Event ID 4732) are a top persistence signal.