Cyberpediaby Brain
ENDEFR

Protecting administrator accounts (PAM)

An administrator account opens every door. Here is how PAM protects it and what employees and their managers do day to day.

In 30 seconds

Where it happens
On any system where someone holds administration rights, in the company directory, on a workstation, a server or an online service.
What the attacker wants
To obtain the credentials of an existing account, in order to act without drawing attention4.
The reflex
Use an administrator account only to administer, never for email, the web or office work, and request the rights when the need arises.
If it has already happened
Tell the security team.

What it is

A privileged account is a system account that holds the authorizations of a privileged user1. A privileged user is a person authorized, and therefore trusted, to perform control, oversight, administration or security functions that ordinary users are not allowed to perform2.

This account does not necessarily belong to a member of the company's IT staff. The UK NCSC uses the word "administrator" for an individual, such as a database administrator, as well as for a system account that runs a scheduled task, and points out that administration is often entrusted to a third-party supplier3. All of them have permissions above those of a normal user3. Privileged Access Management, or PAM, is the set of rules and tools that govern these accounts.

Straight answers

What is a privileged account?

It is an account whose rights exceed those of an ordinary user: creating a user in a domain, connecting over SSH to a web server to modify a file, and configuring an alarm on an industrial valve are three examples given by the NCSC3. All of these actions can be used to cause harm, which is why they need protecting3.

Why do attackers target these accounts first?

Stolen credentials make it possible to get around access controls. They are also used to keep lasting access to exposed services such as VPNs, web email or remote desktop4. A compromised account can also give a higher level of privilege on certain systems or access to restricted areas of the network4. With a legitimate credential, the attacker can do without malware, which makes their presence harder to spot4.

Microsoft describes the same mechanism for the Active Directory directory: the attacker extracts credentials from open sessions and looks first for accounts that already have elevated rights, which they then impersonate5. The usual targets are accounts with permanent privileges, executive accounts, directory accounts with privileges and domain controllers5.

Can you read your email with an administrator account?

No. Microsoft lists browsing the internet while logged in to a privileged account, and logging in from an unsecured computer, among the behaviors that increase the risk of credential theft5. The publisher recommends not using highly privileged accounts for routine administrative tasks when this can be avoided5. Secure administration workstations run no email application, no browser and no office software5.

What does PAM mean in practice?

The NCSC gives the guiding line: carefully control who administers, where, when, why and how, give administrators the least privilege, and remove access when it is no longer needed3. At Microsoft, the Privileged Identity Management service makes it possible to manage, control and monitor access to important resources in the organization6. MITRE adds the monitoring of how privileged accounts are used, and accountability ensured by logging and auditing7.

1How it works2 min

A PAM brings together several building blocks.

First, a password vault. MITRE recommends vaulting tools for storing and rotating credentials, and cites CyberArk, HashiCorp Vault or KeePass as examples7. For local administrator passwords, the same page cites Microsoft LAPS7.

Second, temporary elevation of rights. In Microsoft Entra's Privileged Identity Management service, an employee can be "eligible" for a role without holding it permanently. When they need it, they activate it for a limited time, within a maximum set by administrators, stating the reason for the request6. Activation can require a multifactor authentication check, a business justification or approval from a designated approver6. After the time limit, the role switches off: this is the "just in time" access principle, where temporary permissions prevent a malicious or unauthorized user from getting in after they expire6. The same service sends a notification when a privileged role is activated and allows access reviews to check that everyone still needs their role6.

Third, traceability. The NCSC asks for all administration activity to be logged and audited, to check that administrators carry out only legitimate, approved actions3. Microsoft's service lets you download the audit history6. Microsoft also recommends monitoring the directory for signs of attack5.

Fourth, strong authentication. It requires at least two proofs of identity: what you know, what you have, what you are8. MITRE advises imposing it on all privileged accounts7 and in particular on privileged roles8. Microsoft requires it when privileged accounts are used or for administration tasks5.

Finally, separation of accounts. In its model, Microsoft creates a secured workstation user account and a separate device administrator account9. The NCSC recommends tiered administration, because not all administration carries the same risk3.

2What you do1 min

An employee's actions come down to four points.

  • Keep two uses separate. The everyday account is for email, the web and office work. The administration account is used only to administer, on a workstation set up for that purpose5.
  • Request rights when needed. If your role requires elevated access from time to time, use your company's activation or approval-request procedure rather than keeping permanent rights6. Microsoft goes the same way: eliminate permanent membership in highly privileged groups and grant temporary membership when it is needed5.
  • Accept strong authentication. Microsoft asks for it to be imposed at least on administrators9.
  • Do not keep local administrator rights on your workstation without need. Microsoft plans to remove these rights from the users of its privileged workstations9, and MITRE recommends removing users from the local administrators group7.

For a manager, the task is to limit the number of people who have access to sensitive information, which reduces the risk that a malicious actor gets to it and that an authorized user inadvertently touches a sensitive resource6. A designated approver receives an email notification when a role request is waiting for approval6.

3Pitfalls1 min
  • The reused administrator password. MITRE explains that password reuse can allow local accounts to be abused across a set of machines, to raise privileges and move from one workstation to another10. Microsoft lists local privileged accounts with the same credentials on all systems among risky configurations5.
  • The dormant account. The attacker can abuse inactive accounts, for example those of people who have left the organization, because the original user is no longer there to notice abnormal activity4. Access reviews make it possible to check that users still need their role6.
  • Too many powerful accounts. Assigning too many users to privileged domain groups encourages their excessive use5.
  • Credential theft. Logging in with a privileged account on an unsecured computer exposes those credentials5.
  • Overlapping rights between local, domain and online accounts. MITRE is concerned about this, because the attacker can move from one account and system to another up to a domain or enterprise administrator level4.
4Real cases1 min

Attack on the Ukrainian power grid, 2015

In this attack, the Sandworm Team group used valid accounts on the corporate network to raise its privileges, move laterally and establish itself durably in that network4.

Fact sheet

Identifier
CP-198
Wing
3. Protocols and defence
Brain skill
Controlling Access (control_access)
Brain reflex
cr-030
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
10 sources checked on 3 November 2026
Sources10 sources
  1. NIST, “privileged account - Glossary | CSRC”. https://csrc.nist.gov/glossary/term/privileged_account (accessed 3 November 2026)
  2. NIST, “privileged user - Glossary | CSRC”. https://csrc.nist.gov/glossary/term/privileged_user (accessed 3 November 2026)
  3. NCSC (UK), “Secure system administration”, 15 September 2020. https://www.ncsc.gov.uk/collection/secure-system-administration (accessed 3 November 2026)
  4. MITRE ATT&CK, “Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1078/ (accessed 3 November 2026)
  5. Microsoft, “Best practices for securing Active Directory”. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory (accessed 3 November 2026)
  6. Microsoft, “What is Privileged Identity Management? - Microsoft Entra ID Governance”. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure (accessed 3 November 2026)
  7. MITRE ATT&CK, “Privileged Account Management, Mitigation M1026 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/mitigations/M1026/ (accessed 3 November 2026)
  8. MITRE ATT&CK, “Multi-factor Authentication, Mitigation M1032 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/mitigations/M1032/ (accessed 3 November 2026)
  9. Microsoft, “Deploying a privileged access solution - Privileged access”. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-deployment (accessed 3 November 2026)
  10. MITRE ATT&CK, “Valid Accounts: Local Accounts, Sub-technique T1078.003 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1078/003/ (accessed 3 November 2026)

Cite this article

Brain, “Protecting administrator accounts (PAM)”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/privileged-access-management-pam-admin-accounts/

BibTeX 
@misc{brain_cp198_en_2026,
  author = {Brain},
  title = {Protecting administrator accounts (PAM)},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/privileged-access-management-pam-admin-accounts/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence