Some users need local admin rights for development and research work. We use separate admin accounts and Duo already, but managing those accounts is a hassle. Could Duo on UAC prompts replace them, and what should we watch for when deploying it broadly?
Can Duo protect Windows UAC elevation without separate admin accounts?
Asked by
+activate!the~footpedal
Answers
I would keep the separate admin accounts. A Duo prompt at UAC elevation doesn't necessarily protect every way an admin credential can be used. In particular, non-interactive authentication may not get the same Duo check, so putting admin rights on the everyday account can leave another path to those privileges.
Duo can add a check to an interactive elevation flow, but that is not the same thing as making the account's admin rights available only after MFA. Check the coverage of the specific integration and configuration before relying on it that way.
Reply to this answer
For a wider deployment, offline access and lockout recovery deserve a pilot of their own. Test what happens when a laptop can't reach Duo, when a user has lost their authentication device, and when the service or client isn't working.
Decide on a recovery process before rolling it out. Then try the same tests across the client configurations you actually support. A setting that makes offline access easier may change the protection you're expecting, so review that tradeoff explicitly.
Reply to this answer
This sounds more like a privilege management problem than a UAC prompt problem. A just in time elevation tool could grant elevation when needed instead of leaving users with standing local admin rights. The catch is that it needs funding and central support, so it may not be available as a quick fix.
+activate!the~footpedal:
Licensing is the sticking point for us. The need for elevation is real, but a centrally funded tool isn't currently on the table.
Reply to this answer
Application allowlisting is another option to investigate. Depending on the work involved, a product that permits specific approved applications to run elevated may reduce the number of people who need broad local admin rights. It won't necessarily cover every development or hardware research workflow, though, and it still needs central deployment and administration.
Reply to this answer
Add your answer
Answers are reviewed before publication.
+activate!the~footpedal:
That distinction helps. Can Duo be required just for the accounts with admin rights?
+brisk~but!unbothered:
Check the current Duo deployment and policy documentation for the integration you plan to use. Test the account targeting and the actual logon and elevation paths rather than assuming a UAC policy covers them all.