ASD ISM 1835 Restrict delegation of privileged Active Directory accounts

IT teams should mark privileged accounts as sensitive in the Active Directory system.

You can do this by accessing the properties of each account and ticking the option that labels it as sensitive. This setting prevents other accounts from gaining the same privileges by delegation.

System administrators should review all accounts with high privileges regularly.

Go through the list of accounts with the ability to change significant settings or access sensitive data, and confirm that they are marked as sensitive. This helps ensure no account is overlooked.

Managers should set up a policy review to ensure delegation settings are accurate.

Work with IT to create a checklist of accounts that should never be delegated, update policies to reflect this, and communicate the importance to all relevant staff.

Human Resources should coordinate with IT to review account privileges when employees move roles or leave.

Ensure that any changes are reflected immediately in the system to prevent unnecessary or incorrect delegation of power.

Security officers should organise training sessions for staff to understand the importance of protecting privileged accounts.

Use simple scenarios to explain the risks of mishandling these accounts, and offer practical guidance on maintaining vigilance.