An attacker who compromised one workstation used its local administrator password to log in to dozens of other workstations, because every machine had the same local administrator password. Which control BEST prevents this lateral movement path?
Select an answer to reveal the explanation.
Short Explanation
One key for every door means one stolen key opens every door. Give each machine its own local admin password that rotates, and a stolen one only works on that one box. Swapping in a domain admin is the trap - you just upgraded the stolen key to a master key.
Full Explanation
Local privileged accounts exist on a single system, while global privileged accounts, such as domain administrators, have authority across many systems. When every workstation shares the same local administrator password, that local account behaves like a global credential: compromise one machine, harvest the credential, and reuse it everywhere. A local administrator password solution generates a unique, complex password for each machine, rotates it on a schedule or after use, stores it in a protected directory or vault, and restricts who can retrieve it. A credential stolen from one workstation then works only on that workstation. Replacing local admin accounts with domain administrator logons makes the problem worse; domain admin credentials cached or used on workstations expose the most powerful account in the environment to theft. Lengthening the shared password improves resistance to guessing but does nothing against reuse, because the attacker extracted the credential rather than guessed it. Disabling auditing of local administrator logons removes the evidence needed to detect lateral movement without reducing the risk at all. Exam caveat: pair unique local passwords with restrictions on network logon for local accounts. Operational check: query several workstations' managed local admin passwords and confirm each is different and recently rotated.