This is the strategy that changes how people work, which is why it fails for organisational reasons rather than technical ones. The controls are well understood. Persuading administrators to accept a second workstation and a jump server is the actual project.
It is also the strategy that most directly limits blast radius. Everything else reduces the chance of compromise; this one decides what an adversary can do afterwards.
Maturity Level One: separation and isolation
- Requests for privileged access validated when first requested — approval, not automatic inheritance from a role.
- Privileged accounts, excluding privileged service accounts, prevented from accessing the internet, email and web services.
- Privileged users operating separate privileged and unprivileged environments.
- Unprivileged accounts unable to log on to privileged environments, and privileged accounts unable to log on to unprivileged ones.
The internet restriction is the highest-value item in the entire strategy. It severs the path by which a domain administrator opens a malicious document at lunchtime. It is also the one administrators resent most, because looking up documentation is genuinely part of the job — which is exactly why the second, unprivileged environment has to be good enough to work in.
Maturity Level Two: management and visibility
- Privileged access revalidated at least annually.
- Privileged accounts disabled after 45 days of inactivity.
- Administrative activities conducted through jump servers.
- Credentials for break glass, local administrator and service accounts long, unique, unpredictable and managed.
- Privileged access events, and privileged account and group management events, centrally logged.
Service account credentials are where this stalls. Rotating them risks breaking things nobody fully understands, so it slips to a later phase indefinitely. Treat it as its own workstream with its own discovery, not as a line item.
Track privileged access requirements by level
GRC Copilot separates the Level One, Two and Three requirements so you can see exactly what is new at each step and evidence it.
Try GRC Copilot free Generate an AI-powered assessment Download checklist Book a demo
Maturity Level Three: remove the standing prize
- Just-in-time administration — privilege granted for a task and withdrawn afterwards.
- Windows Defender Credential Guard and Remote Credential Guard enabled.
- Privileged access and account management logs protected from unauthorised modification and deletion.
Just-in-time is the conceptual shift: rather than defending standing administrative accounts, you stop having them. An adversary who compromises an administrator's workstation at 3am finds an account with no privileges attached.
Credential Guard addresses the complementary problem — credentials sitting in memory to be harvested after a foothold is gained.
Landing it without a revolt
- Build the unprivileged environment first, and make it good. If administrators cannot read vendor documentation, search error messages and use collaboration tools comfortably, they will route around the control and you will have neither compliance nor goodwill.
- Pilot with the team that owns the change. Infrastructure administrators will find the friction and can fix it.
- Automate the 45-day disablement. A manual quarterly review cannot evidence a 45-day rule.
- Inventory service accounts before touching them. What runs as them, what breaks, what owns them.
- Include cloud administration. Teams routinely implement the on-premises jump path and then administer cloud tenancies from ordinary laptops — assessors notice.
Every failed rollout of this strategy shares one root cause: the unprivileged environment was an afterthought, so the privileged one stayed the place people actually worked.
Evidence to hold
The privileged account inventory including service, break glass and local administrator accounts; access request and approval records; enforced evidence of the internet, email and web restriction; configuration showing the environment separation and logon restrictions; from Level Two, revalidation records, automated inactivity disablement, jump server configuration and central logs; from Level Three, just-in-time grant records, Credential Guard status and log tamper protection.
Frequently asked questions
Do administrators need two physical machines?
Not necessarily. The requirement is separate operating environments, which can be met with a well-implemented virtual or remote privileged environment. What does not satisfy it is one desktop where an administrator elevates in place.
How do we handle break glass accounts?
Keep them, protect them and monitor them. Their credentials must be long, unique, unpredictable and managed, and their use should be alerted on. They are an exception to just-in-time by design, not an oversight.
Does this apply to cloud administrator roles?
Yes. The intent follows privilege, not infrastructure location. Global administrator roles in a cloud tenancy are privileged accounts, and applying the requirements only on-premises is a common and easily spotted gap.
What counts as just-in-time administration?
Privilege granted for a defined task and time and removed afterwards, with the grant recorded. Several platform and third-party approaches qualify. The test is whether standing privilege has genuinely been eliminated rather than merely re-labelled.
Key takeaways
- Blocking internet, email and web from privileged accounts is the highest-value item here.
- The unprivileged environment must be genuinely usable or the control gets routed around.
- Service account credential management is a workstream, not a task.
- Just-in-time removes the prize instead of defending it.