Run the same action as three account types and record what each is refused

short · 35 min · Objective 2.1

Task

Create a standard account on the disposable guest and attempt a set of administrative actions as each account type, recording what happens. The argument for least privilege is far more convincing once you have watched the same action succeed and fail depending on who ran it.

Steps

  1. Create a standard account and an administrator account on the guest, and record both in lab/accounts/accounts.csv with header account,type,groups.
  2. Attempt at least six actions as the standard account -- install a driver, write to a protected folder, create a service, change another account, modify a protected setting, install an application -- and record each in lab/accounts/actions.csv with header action,as_standard,as_admin,prompt_type.
  3. For any action that appeared to succeed as the standard account, find where the write actually landed and record it in lab/accounts/redirect.md.
  4. Record the local group membership and the state of the built-in accounts in lab/accounts/builtin.csv with header account,enabled,should_be,reason.
  5. Write lab/accounts/uac.md recording which prompt type each action produced -- consent or credentials -- and what clicking yes actually granted.

Verify

awk -F, 'NR>1 && NF>=3 {n++} END {print n" account(s)"}' lab/accounts/accounts.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" action(s) tested"}' lab/accounts/actions.csv
awk -F, 'NR>1 && $2 ~ /refus|denied|fail/ {n++} END {print n" refusal(s) as standard"}' lab/accounts/actions.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" built-in account(s)"}' lab/accounts/builtin.csv
grep -Eic 'consent|credential' lab/accounts/uac.md

Six actions tested with at least three refused as the standard account, and both prompt types identified. If nothing was refused, the "standard" account is in the administrators group -- which is itself the finding this lab most often produces on real machines.

Notes

The silent-success case is the interesting one. An older application writing to a protected folder without elevation is redirected to a per-user copy; the write succeeds, the application is content, and the file is not where anyone will look for it.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.