Why nobody follows the advice
Jan 14th, 2023 by Jesper Kråkhede
In my previous post I listed Microsoft´s recommendations for the built-in groups in Active Directory. None of it is secret and none of it is new. So why do I almost never find an environment that follows it?
The honest answer is convenience and old habits. Being Domain Admin is convenient. Everything works, no permission is ever missing, nobody has to file a ticket. And once a habit is set, it stays. The admin who got Domain Admin in 2008 to install a printer driver still has it.
But underneath the convenience there is something else: lack of resources. Cleaning up privileged groups takes time. Someone has to find out what each account is used for, test what breaks when the rights are removed and build a better way of delegating. In a small IT team where two people run everything from the network to the phones, that work never makes it to the top of the list. There is always something more urgent.
For management, the question isn´t whether your admins know the recommendations. Most do. The question is whether they have the time and the mandate to implement them.
Give them a few weeks to clean up, and back them when someone complains about losing a right they never needed.
Old habits are free. Until the day they aren´t.