ISR04: Insecure Resource and User Management
How ISR04: Insecure Resource and User Management works
Insecure resource and user management is the drift between who actually holds rights on a host and who still needs them. It lives on the endpoint and in the joiner-mover-leaver process, not in any single tool. Local administrator membership, the built-in Administrator account and every enabled login accumulate faster than anyone reconciles them, so a fleet ends up carrying rights that map to nobody’s current job.
It survives because the day-one grant is visible and the day-N review is not: adding a helpdesk group to local Administrators fixes a ticket now, removing it fixes nothing anyone is measuring. There is no error message for an account that should have been disabled six months ago. After initial access it is what turns one foothold into fleet control - local admin yields credential material and EDR tampering, a shared built-in password authenticates laterally with no cracking, and a forgotten enabled account is a login that no alert owner watches. The three chapters below take one surface each: Local Administrator Rights Sprawl covers who holds admin on their own machine, Shared Local Administrator Passwords covers one built-in password reused fleet-wide, and Stale And Orphaned Accounts covers logins that outlived their owner. Directory-wide privileged group sprawl and domain password policy live on the Active Directory pages, not here.
Keywords: local admin rights, laps, orphaned accounts, stale accounts, last logon, joiner mover leaver
Examples/Proof
- Local admin census
- Enumerate the local Administrators group on a representative host sample and compare membership to a named owner list. Any standard user or blanket helpdesk group present on machines it does not support is a finding.
- Built-in password reuse
- Read the built-in Administrator hash from one lab host, then authenticate to a second host with it. A pass-the-hash success against the second machine proves one password spans the fleet.
- Enabled-but-dead login
- Cross a directory export of enabled accounts against the current HR leaver list. An enabled, non-expired account for a departed employee is an orphan.
- Password older than policy
- Report accounts whose password age exceeds the stated maximum. A service account with a password set years ago shows the rotation control never applied to it.
Detection and Monitoring
- Local group membership baseline
- Feed periodic local-group exports into the SIEM; alert when Administrators membership changes outside a change window or drifts from the approved set.
- Interactive logon by service accounts
- Watch 4624 type 2 and type 10 for accounts flagged non-interactive; an interactive or RDP logon by a service identity is suspect.
- Last-logon age report
- Run a scheduled last-logon-timestamp report; any enabled account past the dormancy threshold with no disable is a gap.
How to fix and prevent ISR04: Insecure Resource and User Management
- Inventory who holds admin and which accounts are live before changing anything
- You cannot right-size rights you have not counted. Export local Administrators membership and enabled-account last-logon fleet-wide first.
- Remove standing local administrator from standard users
- Move install and elevation needs to a brokered or just-in-time path. Partial control only if a shared local admin password still exists to fall back on.
- Deploy per-host randomised built-in passwords
- LAPS or an equivalent so each machine’s built-in Administrator password is unique and rotated; this closes the lateral reuse path directly.
- Wire disable-on-leave into the joiner-mover-leaver process
- Trigger account disable from the HR leaver event, not a periodic sweep, and expire service accounts whose owning system is decommissioned.
- Reconcile the directory against HR and asset records on a schedule
- Age and last-logon reporting catches what the process misses; disable first, delete after a hold period so you can reverse a mistake.
Prevention Checklist
- No standard user holds standing local administrator on their own machine
- Every host’s built-in Administrator password is unique and centrally rotated
- Account disable fires from the HR leaver event within a defined SLA
- A scheduled report lists enabled accounts past the dormancy and password-age thresholds
In this section
- Local Administrator Rights SprawlLocal administrator rights sprawl is standard users holding admin on their own machines, plus support groups nested into local Administrators.
- Shared Local Administrator PasswordsShared local administrator passwords are one built-in Administrator secret reused on every host because LAPS or an equivalent was never deployed.
- Stale And Orphaned AccountsStale and orphaned accounts are enabled logins that outlived their purpose, from departed staff to service accounts whose system is gone.
Last updated
