One of the quietest killers of business networks is the excessive provision of local administrator rights. For years, the default for many small IT setups was to simply make everyone a local administrator to prevent "it won't install" support tickets. The ACSC Essential Eight explicitly outlaws this practice.
The Principle of Least Privilege
The control "Restrict Administrative Privileges" mandates that users should only be granted the privileges they absolutely need to perform their duties. When a user runs as a standard user, any malware they accidentally trigger is confined. However, if they are logged in with admin privileges, the malware inherits those rights and can rewrite the registry, disable basic antivirus software, and compromise the entire network.
Separation of Duties
Even for your IT personnel, the ACSC requires strict boundaries. An IT manager should have an "Admin" account for server maintenance and a separate standard "User" account for emails, browsing, and reading documents. Administrative accounts should never be used to browse the internet.
How to Implement Slowly
Removing admin rights from long-time employees often results in friction. Begin by auditing who actually has access, and communicate the severe security risks. Temporary Privileged Access Management (PAM) tools can be used to grant "Just-in-Time" admin access for necessary installations.
To see how administrative privileges affect your overall maturity score, measure your business in our Essential Eight Dashboard.