Thread by @RyanLNewington

Users having admin rights on *their* desktop is no where near as big as a problem as your support staff having admin rights on *all* desktops. To stop ransomware we need to move away from super-charged admin rights that work everywhere. 💣

Start by removing domain admins from the local admins group of every computer. Windows adds them by default when a PC is first joined to the domain. Setup a group policy to remove them. Domain admins need to be an admin of DCs only. Talk about an overprivileged account! 😫

Then rollout LAPS and have support staff use LAPS passwords instead of their own admin accounts. (why would you type a super-admin account password into a PC where you have no idea what's on it) 😬

Once you have rolled out LAPS, remove everyone from the local administrators group except the built-in admin (now managed by laps). (And the user if they need admin rights on their PC and that's your thing)

You've just broken the primary means to which ransomware can move laterally through your environment. 👍 It's not the end of the job, but with a robust patching process, you've crippled most commodity malware from spreading laterally.

PS. Smooth the organisation change component of moving your support staff to LAPS by not making them suffer with the LAPS GUI. Web based, mobile friendly, MFA support, more secure, better logging github.com/lithnet/laps-w…

Or you can jump on the beta of Access Manager, the next generation of laps web - Lithnet Access Manager github.com/lithnet/access…