Essential Eight RA-ML1.6 Unprivileged user accounts restricted from logging on to privileged environments
What it says
Unprivileged user accounts cannot logon to privileged operating environments.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that non-admin accounts cannot access admin-level systems.
This control ensures that regular users can't access systems where important administrative tasks are done. Imagine if a regular worker accidentally deleted important files or changed system settings. By restricting access, we prevent potential mistakes and protect the organisation from intentional harm.
Free. Save your status, tasks and notes.
Why it matters
If unprivileged users can log on to privileged environments, attackers can pivot to admin sessions, elevating access and causing outages.
How to implement
IT team: Identify which computers and systems are used for administrative tasks and separate them from normal user environments.
System administrator: Create separate accounts for users with administration duties, ensuring they use these only for admin tasks.
Security officer: Regularly review user accounts to ensure no unprivileged accounts have access to privileged environments.
IT team: Implement network policies that block unprivileged accounts from logging into sensitive computers or servers.
Keep it running
Audit logon rights on privileged hosts (servers/admin workstations) and allow only admin accounts; deny standard users via GPO/PAM.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you prevent unprivileged accounts from accessing admin environments?
Look at
Examine the network configuration and access control lists.
Good evidence
Configurations clearly restrict unprivileged accounts from admin systems.
- Check 2 of 2What an auditor asks for
Ask for
Are there regular checks ensuring compliance with this separation?
Look at
Review audit logs and records of recent access reviews.
Good evidence
Documented evidence showing routine checks with no instances of breach.
Mappings
Closest match in ASD Information Security Manual: ISM-1688, Block unprivileged account logons to privileged operating environments, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.15.
E8-RA-ML1.6 requires a specific access control outcome: unprivileged accounts cannot logon to privileged operating environments. ISO/IEC 27001:2022 Annex A 5.15 requires organisations to establish and implement access control policies and procedures, under which rules like those in E8-RA-ML1.6 would typically be defined. Annex A 5.15 is broader and policy-oriented, while E8-RA-ML1.6 is a concrete technical restriction targeting privileged environment logons.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1688.
E8-RA-ML1.6 requires that unprivileged accounts are prevented from logging on to privileged operating environments. ISM-1688 states the same requirement: unprivileged user accounts cannot logon to privileged operating environments. Both controls focus on enforcing logon restrictions to protect privileged/admin environments from exposure to lower-trust accounts.
- ISM-1380Privileged users work in separate privileged and unprivileged operating environmentsPartially overlaps
This control partially overlaps ISM-1380.
E8-RA-ML1.6 requires that unprivileged accounts are prevented from logging on to privileged operating environments. ISM-1380 requires privileged users to use separate privileged and unprivileged operating environments, which typically relies on access restrictions that also prevent cross-use by unprivileged accounts. ISM-1380 additionally mandates operational separation for privileged users, while E8-RA-ML1.6 is specifically about blocking unprivileged logons to privileged environments.
This control partially overlaps ISM-1689.
E8-RA-ML1.6 requires that unprivileged accounts cannot logon to privileged operating environments. ISM-1689 addresses the inverse direction by requiring privileged accounts cannot logon to unprivileged operating environments, reducing credential exposure and lateral movement. Together they enforce two-way separation between privileged and unprivileged contexts, but each control targets a different logon direction and account type scope.
This control partially overlaps ISM-1927.
E8-RA-ML1.6 requires that unprivileged accounts cannot logon to privileged operating environments. ISM-1927 limits access to key identity infrastructure servers to privileged users who require access, which strengthens protection of privileged environments by reducing who can reach them. ISM-1927 is broader in that it governs authorisation to access particular server classes, while E8-RA-ML1.6 is specifically a logon restriction based on account privilege level.
- ISM-1958Block DCSync-permitted accounts from logging on to unprivileged environmentsPartially overlaps
This control partially overlaps ISM-1958.
E8-RA-ML1.6 requires preventing unprivileged accounts from logging on to privileged operating environments. ISM-1958 requires that accounts with DCSync permissions cannot logon to unprivileged operating environments, which is a specialised privileged-account separation measure. Both reduce cross-context logon to limit credential theft pathways, but ISM-1958 is narrower and focused on a specific high-risk privilege and the privileged-to-unprivileged direction.
This control depends on ISM-0445.
ISM-0445 requires a separation between standard user accounts and privileged accounts, with privileged accounts used only for privileged duties. E8-RA-ML1.6 supports that separation by technically preventing unprivileged accounts from logging on to privileged operating environments, reducing the incentive to use the everyday account for admin tasks. E8-RA-ML1.6 is an environment logon restriction, while ISM-0445 is an account assignment and usage rule.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-05.1Restrict administration to dedicated, hardened environments isolated from unprivileged user workloadsPartially overlaps
This control partially overlaps IT.PRO-05.1.
IT.PRO-05.1 requires administration to happen only in dedicated, hardened environments isolated from unprivileged user workloads; E8-RA-ML1.6 stops unprivileged user accounts logging on to privileged operating environments, enforcing that isolation from the unprivileged side.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.