An organization wants to implement the principle of least privilege on Windows workstations. Currently, all users are local administrators. What is the primary security risk of this configuration and the recommended change?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because local administrator rights allow code (including malware) to install persistent services, modify registry, disable security tools, and dump credentials; removing users from the local Administrators group and running as standard users dramatically limits the impact of malware or exploited vulnerabilities. A is wrong because local administrator accounts are separate from domain accounts; standard users can join domain-joined workstations.
Full explanation below image
Full Explanation
B is correct because local administrator rights allow code (including malware) to install persistent services, modify registry, disable security tools, and dump credentials; removing users from the local Administrators group and running as standard users dramatically limits the impact of malware or exploited vulnerabilities. A is wrong because local administrator accounts are separate from domain accounts; standard users can join domain-joined workstations. C is wrong because modern Windows applications (post-UAC era) are designed to run as standard users; applications requiring admin rights should use UAC elevation prompts or be managed separately. D is wrong because local admin rights have significant security implications including credential theft enablement and security control bypass.