Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

3
  • 1
    The problem lies in the fact that an administrator cannot safely log on to a computer on the enterprise without risking compromising all other computers due to account hijack. Commented Jul 12, 2013 at 18:21
  • 1
    The problem is that if a user has local admin on a box they can get a SYSTEM shell and dump passwords (and SYSTEM can get everybody's -- you don't need to be the user). Commented Jan 21, 2016 at 16:37
  • You forget that the person logging in might not be doing so with the local administrator password (which is already breached according to you since you need SYSTEM to access LSASS). It might also be a domain admin logging into your system and leaving his credentials. Or maybe it's a support account with admin access on all laptops or servers. You can then escalate from a local admin -> system -> domain admin or admin on all servers/systems. Commented Feb 10, 2021 at 15:56