---
title: "Principle of Least Privilege"
description: "Principle of Least Privilege states that a subject should be given only those privileges needed for it to complete its task."
category: "Security Tips"
subcategory: "Security Tipps"
last_updated: "2023-04-06"
source_url: "https://docs.xeox.com/security-tips/5bjCurHWKkyKsunBs6j6JF/principle-of-least-privilege/wZozUF4wrYxMqgonTGjziH"
---

# Principle of Least Privilege

Hacker attacks are becoming more and more intelligent and, above all, more individual. It is helpful to implement the **Principle of Least Privilege** in the active directory to help prevent your system from being attacked. Principle of Least Privilege states that a subject should be given only those privileges needed for it to complete its task.

## User

#### Step 1

Create these Users and Groups in AD:

DA - Domain AdminSA - Server AdminCA - Client Admin

- CA-, SA-, DA- User(example: CA-hs2n)
- gg\_ServerAdmin -group; gg\_ClientAdmin -group

#### Step 2

Assignment:

- CA - User member of gg\_ClientAdmin
- SA - User member of gg\_ServerAdmin
- DA - User member of Domain-admins

#### Step 3

Create a **ClientAdmin** Policy **OR** if you imported a policy, edit gg\_ClientAdmin-

Link the policy to all your client organisation units

For testing purposes **do NOT** use the option "Remove Members: Domain-Admins" in the first step After you made sure that the policy works correctly and you have access to the clients with your previously created CA-admin users, edit the policy and add the option "Remove Members: Domain-Admins"

> IMPORTANT:
> 
> As per default new domains that join computerobjects are created in the group "Computers". THIS IS NOT A OU, IT IS A GROUP! A group can not be linked to a policy - You have to create a new OU and make it default for any new domain joining computerobjects. To do so, start a Powershell as an administator:

![notion image](https://docs.xeox.com/media/43e4994f9474bb7e.png)

Use the following commands:

`redircmp <NEW OrganisationUnit>`

`redircmp „ou=NewComputer, DC=Testdomain, DC=local“`

To check the default path use the following command:

`get-addomain | fl computer*, user*`

![notion image](https://docs.xeox.com/media/02e9806bd17cfd68.png)

#### Step 4

Create a **ServerAdmin** Policy **OR** if you imported a policy edit gg\_ServerAdmin.

Link the policy to all your client organisation units.

For testing purposes **do NOT** use the option "Remove Members: Domain-Admins" in the first step After you made sure that the policy works correctly and you have access to your servers with the SA-admin users you poreviously created, edit the policy and add the option "Remove Members: Domain-Admins"

![notion image](https://docs.xeox.com/media/86e003b1d45f753c.png)

#### Step 5

To make sure that the previously created users can only log on to their intended devices(Servers, DC, Clients):

- DA-users: only allowed to log on DC, not on other servers, not on clients
- SA-users: only allowed to log on servers, not on DC, not on clients
- CA-users: only allowed to log on clients, not on DC, not on servers we have to apply the following GPOs:
1. For DA-Users

![notion image](https://docs.xeox.com/media/66dba8ccc3a38b28.png)

Link this GPO to all OU with **ComputerObjects and MemberServerObjects**.

2. For SA-Users

![notion image](https://docs.xeox.com/media/8ca382b80a770cd0.png)

Link this GPO to all OU with **ComputerObjects and DomainControllers**.

3. For CA-User:

![notion image](https://docs.xeox.com/media/de34481383cbd445.png)

Link this GPO to all OU with **DomainControllers and MemberServerObjects**.

## LAPS

[Click here for more Information!](https://docs.xeox.com/security-tips/5bjCurHWKkyKsunBs6j6JF/laps/wjrQNiMRMMFmAMfqzE33kV)