ADMINISTRATIVE TASK
. | HOW TO DELEGATE THE TASK
. | SECURITY IMPLICATIONS OF TASK
(when performed with malicious intent) |
|
|
| 1. Create a user account | Grant Create Child permissions on the parent object to create User objects | Engage in malicious activity that cannot be traced back to real user. |
|
| 2. Delete a user account | Grant Standard Delete permissions on the user object or Delete Child on the parent object | Disrupt user's access and require IT to completely reprovision access for user. |
|
3. Reset a user account's
password | Grant Reset Password extended right on the user object | Logon as user and access every IT asset to which user has access. |
|
| 4. Disable a user account | Grant Write Property permissions on the user object to modify the User-Account-Control attribute | Prevent a user from logging on and engaging in computing activities. |
|
| 5. Unlock a user account | Grant Write Property permissions on the user object to modify the Lockout-Time attribute | Thwart account lockout when trying to guess or brute-force user's password. |
|