How it works
Routine users should not use administrator permissions. Authentication logs, update logs, and system events can reveal suspicious changes.
Use standard accounts for normal work, admin accounts for approved maintenance, and logs to investigate unexpected behavior.
Common error
Shared administrator accounts reduce accountability because actions cannot be tied to a person.
Worked example
Build a timeline from device and account evidence.
Evidence
10:00 individual user login
10:03 new administrator account
10:04 endpoint alert
10:06 device isolatedThe sequence makes the new privileged account a key investigation lead. Verify whether there was an approved change, correlate the responsible session and process, and preserve the records. Chronology supports a hypothesis but does not establish intent without further evidence.
Exercises
4.4.1
Why do individual maintenance accounts improve investigation over one shared administrator login?
Show solution
They make activity easier to attribute to an authorized identity, support role-specific access, and simplify revocation. Logs still require review because accounts can be compromised.
4.4.2
A user needs to install one approved update. Explain a safer approach than granting permanent administrator access.
Show solution
Use a managed deployment or approved time-limited maintenance privilege. Verify completion, remove the temporary elevation, and record the change.