Intermediate level · Module 2: System Hardening and Access Management · Lesson 3 of 3
Least Privilege and Account Lifecycle
Give people only the access they need, for only as long as they need it.
In this lesson you will
- Apply least privilege
- Manage joiners, movers and leavers
Key concepts
least privilegestandard and admin accountsjoiners-movers-leaversshared accounts
The lesson
Least privilege means each person has only the access their work requires. Daily work uses a standard account; administrator rights are used separately and rarely.
Manage the account lifecycle: create accounts when people join, adjust when roles change, and disable them on the day people leave.
Avoid shared accounts; where unavoidable, store the password in a shared vault and change it when someone leaves.
Step by step
- Create standard and admin accounts on the lab computer.
- Review who has admin rights.
- Write a leaver checklist.
- Plan replacement of shared accounts.
Practice activity
Write the account lifecycle procedure.
Expected result: A procedure covering joiners, movers and leavers with admin rights minimised.
Check your understanding
-
Why should daily work use a standard account?
Show answer
Malware running as a standard user can do far less damage.
-
When should a leaver's account be disabled?
Show answer
On their last day.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.