Local Admin Rights Are Still Common, and Insurers Have Started Asking About Them
In many Irish organisations a large proportion of staff still have local administrator rights on their own laptops. The rights are usually granted when the machine is set up, because it saves support calls later, and they tend to stay in place because removing them creates exactly the calls they were meant to avoid. Few organisations have made a deliberate decision that staff should be administrators. It is simply how the machines were built.
Why local admin rights matter
An account with local administrator rights can install any software, including something that arrived by email or through a search advert, can disable or reconfigure the endpoint protection the IT team believes is running, can read credentials cached on the device and can set up software that survives a restart. These are the same actions an attacker needs in order to turn one compromised laptop into a route into the wider network, and most malware relies on the user having elevated rights in order to do serious damage. Where staff run as standard users, a great deal of what lands on the device is unable to run at all.
When I ask partners how many of their customers’ staff have these rights, the usual answer is somewhere between most of them and nobody has counted. The reason given is almost always the helpdesk, and in the incidents partners describe afterwards the pattern is familiar: a user opened something they should not have, that user was an administrator, and the malware disabled the endpoint protection before an alert was raised.
Granting elevation for the task rather than the person
The organisations that have addressed this no longer give anyone standing administrator rights. When someone needs to install or run something that requires elevation, they request it for that particular action on that particular device. Applications the organisation already trusts are approved automatically, unusual requests are sent to IT for a decision, and files that fail a security check are refused. The elevation expires when the task is complete and each decision is logged against the user, the device and the file involved. Day to day, most staff notice no difference, and the helpdesk deals with a small number of genuine requests rather than a steady stream of routine ones.
What insurers and customers now ask
Privileged access has become a standard question on cyber insurance forms and customer security assessments in Ireland. The forms typically ask whether users have local administrator rights, whether elevated access is time-limited and whether it is logged. Partners tell me this is now one of the questions that determines whether cover is offered on standard terms or comes with an excess and conditions attached. NIS2 lists access control among the measures in-scope organisations are expected to demonstrate, and those organisations increasingly expect the same of their suppliers.
Where to begin
The first step is to establish how many accounts actually hold local administrator rights, which most endpoint management tools can report. Some of those rights will belong to people who needed them once for a task long since finished, and those can be removed without disruption. The remainder belong to people whose work genuinely involves elevation, and they define what any replacement arrangement needs to support. If you would like help assessing the position in your own organisation or a customer’s, Renaissance and our partners across Ireland can do that before any technology is discussed.