Force use of dedicated secondary admin accounts in Intune/AAD environment

Siebeert

8/14/23, 2:21 PM

Short situation sketch:

I inherited a customer environment where all devices are Azure AD joined and managed via Intune. The Azure AD account with which the user logs on, is local administrator.

I need to set up that all users are forced to use a dedicated secondary admin account for all elevated activities, and their day-to-day account should no longer be local admin (meaning: they have to enter a different password when getting a UAC prompt, instead of just clicking Yes). These users are developers and they DO need the ability to run things as admin, so they're supposed to know the admin password.

Any advice on how to go about this?

FYI: the reasoning behind this is compliance with CIS Controls, in this case 4.3.

Things I've considered

I know I can push an extra local admin to all computers via Intune, and then remove other accounts from the Administrators group. However, this means that I would be setting the admin password for all computers to the same thing, which is a security concern. If I would do it this way, is there a way to force them to change the password of their admin account?

I've read about DIY LAPS-solutions via Intune, which would set the passwords randomly. However, the users must know that password and be able to remember it.

0 + 0

microsoft-intune

azure-active-directory

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Force use of dedicated secondary admin accounts in Intune/AAD environment

TH: บังคับใช้บัญชีผู้ดูแลระบบสำรองโดยเฉพาะในสภาพแวดล้อม Intune/AAD

RO: Forțați utilizarea conturilor de administrator secundare dedicate în mediul Intune/AAD

RU: Принудительно использовать выделенные дополнительные учетные записи администратора в среде Intune/AAD.

VI: Buộc sử dụng tài khoản quản trị viên phụ chuyên dụng trong môi trường Intune/AAD

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.