14.1.2 Account Management

Learn the best practices for managing user accounts in an enterprise setting.

Principle-of-Least-Privilege

When setting up a new user account, give them the least amount of privileges and/or permissions needed for them to do their task effectively. This makes sure that nobody cam see or do something that they shouldn't.

Disable the Guest Account

In every Windows version up until Windows 8, there was the ability to sign into a guest account and perform basic functions. However, this guest account could be used by an attacker to elevate their privileges and gain access to secured information.

Restrict Login Times

This helps prevent against unauthorized logins and guards against unusual and suspicious activity. If an employee has shift times from 9 AM to 5 PM, then their login times should be restricted to those times to prevent unauthorized logins after-hours.

Inactivity Timeout

Set a timeout that requires the user to log back into their system with their password after a period of inactivity. This can be set with or without a screensaver.

Failed Attempts Lockout

Set a security policy that requires users to escalate the issue to the system administrator within their organization should they get locked out their company-managed account due to forgetting their password.

Change the Administrator Account's Default Password

This is obvious.

Disable Autorun

Autorun is a feature that automatically runs content on an optical or USB drive the moment it's inserted into the system. This is incredibly dangerous, since if the drive contains malware, the malware will automatically infect the system.

#XIV

#Aplus