Privileged account

"Privileged" covers more than the obvious administrator. In Active Directory the built-in groups Domain Admins, Enterprise Admins, Schema Admins and Administrators are privileged, but so are Account Operators, Backup Operators, Server Operators and Print Operators, whose rights can be turned into domain control; members of these protected groups get adminCount=1, and the SDProp process periodically resets their ACLs from the AdminSDHolder template. On Unix, UID 0 and anyone with unrestricted sudo are equivalent to root. In the cloud, the Entra Global Administrator and Privileged Role Administrator roles, Azure Owner and User Access Administrator, and the AWS account root user can change identity and security settings for a whole tenant. Database sa or DBA accounts, hypervisor and vCenter admins, backup console admins and network device enable accounts belong on the list too.

Many of the most dangerous accounts are not in any admin group. Attack-path tools such as BloodHound reveal "shadow admins": accounts with ACL rights such as GenericAll or WriteDACL on privileged objects, or the directory replication rights that allow DCSync (MITRE ATT&CK T1003.006), which pulls every password hash from a domain controller. Service accounts frequently end up privileged because an installer asked for it, and a shared local administrator password on every workstation turns one compromised laptop into lateral movement across the fleet.

Attackers target these accounts because they make the rest of an intrusion possible: disabling EDR, deleting backups, pushing ransomware through Group Policy. Credentials are usually harvested where administrators log on: an interactive or RDP logon leaves reusable material in LSASS memory on that host, which is why tiered administration forbids tier-0 accounts from signing in to lower-tier machines, and why the Protected Users group and Credential Guard exist.

Baseline controls are well established. Administrators use separate, dedicated privileged accounts with no mailbox or web browsing (CIS Controls v8.1 Safeguard 5.4), protected by MFA (6.5), preferably phishing-resistant, and used from privileged access workstations. Membership is inventoried and reviewed (NIST SP 800-53 Rev. 5 AC-6(7)), use is logged (AC-6(9)), and standing membership is replaced where possible by just-in-time elevation. The AWS root user gets MFA and no access keys. Microsoft recommends at least two cloud-only emergency access (break-glass) accounts that are excluded from normal conditional-access policies, have long random credentials stored offline, and trigger an alert whenever they are used. A privileged account is the object being protected; privileged access management is the discipline and tooling that protects it.