4.3.1. User Accounts, Groups, and Password Policies
💡 First Principle: Every action on a server is performed as some identity. Proper account management—creating accounts with least privilege, organizing them into groups for manageability, and enforcing strong password policies—is the foundation of access control.
User Account Best Practices
- Principle of Least Privilege: Accounts should have only the permissions they need to perform their function, nothing more. A service account that runs a backup job needs read access to data, not domain admin rights.
- Named accounts: Every person should have a unique account. Shared accounts cannot be audited—you can't tell who did what.
- Service accounts: Dedicated accounts for running services. Should have minimal permissions, long complex passwords, and ideally be restricted to specific systems.
- Privileged accounts: Administrative accounts (domain admin, root) should be used only when needed and not for daily tasks.
User Groups
Groups aggregate users for permission management. Instead of assigning permissions to individual accounts (which doesn't scale), assign permissions to groups and add users to groups:
- Security groups: Control access to resources
- Distribution groups: Email distribution only (Exchange/Outlook)
Password Policies
| Policy Element | Purpose | Common Requirement |
|---|---|---|
| Minimum length | Longer passwords are harder to crack | 12+ characters for privileged accounts |
| Complexity | Mix of character types increases entropy | Uppercase, lowercase, numbers, symbols |
| Password history | Prevents reuse of recent passwords | Typically last 24 passwords |
| Maximum age | Forces periodic rotation | 90 days for standard, shorter for privileged |
| Lockout threshold | Prevents brute force attacks | Lock after 5–10 failed attempts |
| Lockout duration | How long lockout lasts | 15–30 minutes, or until admin resets |
⚠️ Exam Trap: Account lockout protects against brute force but can also be used as a denial-of-service attack—an attacker who knows usernames can lock out all accounts intentionally. Balancing lockout threshold and duration requires considering both threat models.
Reflection Question: An administrator creates a single shared "backup" account used by all backup jobs across 20 servers. After a security incident, the security team cannot determine which server's backup job was used to access a restricted file share. What account management principle was violated?
