Do You Leave Your Keys in the Car?
Operating your computer with local admin rights is the digital equivalent of leaving your car keys in the ignition. It feels convenient in the moment—but the second someone jiggles the handle, they don’t just get inside, they can drive off with everything.
Here’s the harsh truth: if your users have local admin rights, so do the hackers who compromise them. One successful phishing email, malware download, or stolen credential doesn’t just give attackers access—it hands them instant power to shut down protections, spread laterally, and hijack your entire network, devices, and data.
What Are Local Admin Rights?
Local admin rights are the highest level of system permission. With local admin rights, a user (or attacker) can:
- Install or uninstall software
- Modify security settings (firewalls, antivirus, group policies)
- Disable essential protections
- Create, delete, or modify user accounts
- Access and alter system files, logs, and configurations
Put simply: local admin rights are the “God mode” of endpoint control. And in the hands of a hacker, they’re the fastest route to full compromise.
The Old [#CYBERinsanity] Ways
For years, businesses have leaned on older, dangerous user device administration models. Two of the most common habits:
- “Everyone gets local admin rights
The “easy” fallback. Users install what they want. No guardrails. One compromised machine becomes a launchpad for a full-network takeover. - IT intervenes with admin credentials
Users don’t get admin rights – but IT or a technician logs in, inputs high-level credentials to install or fix things, then leaves. The problem? Those admin credentials stay cached in session memory or left enabled. Hackers can scrape them and use them later.
Both approaches feel convenient, but they’re quietly handing attackers the keys to your kingdom.
%
Breaches from Misuse of Privileged Accounts
80% of breaches stem from misuse of privileged account access.
That means the majority of cyberattacks start with someone having too many rights—rights the attacker inherits the moment they compromise that account. Source: Devicie
%
Orgs Granting Non-Admins Privileged Access
98% of surveyed organizations say non-administrators are granted privileged access
If 98% of organizations are still handing out privileged access to non-admins, it means attackers don’t need to ‘hack in’ — the keys are already waiting for them inside.Source: LLCBuddy
%
Ransomeware Incidents Starting w/Compromised Creds
In 40% of ransomware incidents where initial access was identified, threat actors used compromised legitimate credentials to access corporate infrastructure (often VPNs or remote systems).
Giving someone local admin or dangling admin creds just gives attackers the same route in—often by bypassing traditional defenses entirely. Source: Cybersecurity Dive
Local Admin Disasters – Are You Next?
It’s not a hypothetical: entire companies have been crippled because a single endpoint still carried local admin rights. Once attackers got in, they didn’t need to hack their way up — they were already holding the keys to disable defenses, spread laterally, and take everything.
- Malware escalation: An endpoint gets infected via phishing. Because the user had admin rights, the malware disables antivirus, installs persistence hooks, and spreads laterally.
- Credential dumping in sessions: An IT tech enters admin credentials to install a tool. Attackers harvest those cached creds and pivot to the entire domain.
- Privilege escalation via vendor accounts: A vendor with admin access manages updates—until their account is hijacked and used for broader control.
PRO TIP: Least Privilege Done Right
Legacy convenience must give way to #CYBERsane controls. Here’s how to do it smarter:
#CYBERinsanity
- Users always run with admin rights
- IT permanently logs in to elevate privileges
- Cached or persistent admin sessions
- No logging or review
#CYBER-Sane Alternative
- Use standard user rights by default
- Use Just-in-Time elevation tools (time-limited, audited)
- Clear tokens and sessions after elevation; no lingering access
- Audit & monitor every elevation event
Bottom line: Convenience for users almost always equals opportunity for attackers. Productivity doesn’t require permanent admin rights—it requires controlled, temporary access that hackers can’t inherit.
Your Local Admin Next Step: Assess & Mitigate
Security is never [done]. Treat admin rights as a liability you must continuously manage: every device, every user, every exception is a potential open door. If you’re not auditing and adjusting constantly, attackers will find the gaps before you do.
- Who currently has admin rights they don’t need?
- What legacy tools demand admin access—can they be sandboxed or upgraded?
- Are we using a tool or policy to enforce temporary elevation rather than permanent privileges?
- Do we log, audit, and review every elevation event?
If you don’t know the answers, you’re already exposed.
Coming Up Next: Why Antivirus Alone Isn’t Enough
Having weak MFA and bad privilege policies is dangerous—but trusting antivirus software alone? That’s like locking your front door but leaving all the windows wide open. In Habit #4, we’ll tackle why antivirus is necessary [but never sufficient] in today’s threat landscape.
Ready to STOP the #CYBERInsanity?
The habits are real. The risks are rising. And doing nothing? That’s not a strategy. Take the #CYBERsane next step now – while you still have a choice.
About the Author:
Matt Tankersley, CISSP is a US Navy combat veteran and the Founder & CEO of TechOnPurpose. Matt is recognized as an innovator with over 35 years of experience in Information Technology specifically in the areas of collaboration, cloud, security, and managed services. Recognizing the complexity, risk and blindsides that business owners face led Matt to create the TOPCYBER21™ Framework, which simplifies how organizations operationalize cybersecurity. Matt’s dedication to customer experience and unwavering belief that “Technology is at the Heart of Business today,” cast the foundation for our culture and simple operating philosophy: “We love what we do, who we do it with, and who we do it for.”
About TechOnPurpose:
Based in Austin, Texas, TechOnPurpose (“TOP”) delivers comprehensive managed IT and cybersecurity solutions to select clients globally. TOP’s approach to managed IT and cybersecurity continues to deliver simplified conversations and comprehensive, affordable solutions for our global customer family of Small & Medium Businesses and Non-Profits.
