Privileged access workstations: designing PAWs that genuinely respect the clean source principle
A domain administrator who signs in from the same workstation used for email and web browsing exposes their credentials to the first piece of malware that comes along. Privileged access workstations, or PAWs, address that problem. They still need to be designed to withstand attacks, not merely to exist.
The clean source principle
The principle is simple: a system cannot be more secure than the systems that control it. If a domain controller is administered from a compromised workstation, the attacker who controls that workstation also controls the domain controller. The whole chain matters: the device, its management system, the accounts that administer it and the network it crosses.
This principle goes hand in hand with the tiering model: Tier 0 covers whatever controls identity (domain controllers, AD CS, synchronisation servers and their administrators), Tier 1 servers and applications, Tier 2 workstations and users. A Tier 0 PAW must not depend on any lower-tier component.
Jump server or dedicated workstation
Many organisations believe a jump server solves the problem: administrators connect to it over RDP and administer from there. The issue is that the connection starts from the office workstation. An attacker on that workstation can capture keystrokes, hijack the session or steal the credentials typed in. The jump server merely moves the problem.
A simple rule. A jump server only adds security if it is reached from a device at least as trustworthy as itself. Accessed from an office workstation, it does not protect Tier 0 credentials.
A jump server is still useful as a controlled network chokepoint, for session recording or for access to tooling, but it complements a PAW rather than replacing it.
Designing the workstation
A credible PAW combines several measures:
- exclusive use: no email, no general web browsing, no office productivity tools;
- application control: only approved administration tools can run;
- hardening: Secure Boot, disk encryption, Credential Guard, no local admin rights for the user;
- network filtering: outbound traffic limited to the administered systems and required services;
- separate accounts: a Tier 0 account is only used on a Tier 0 PAW, and vice versa;
- dedicated management: patches and configuration applied by means that belong to the same tier.
Two physical models exist: a dedicated device separate from the office workstation, or a single device where the admin environment is the host and the office environment runs as a virtual machine. The reverse, administering from a virtual machine hosted on an office workstation, does not respect clean source.
Cloud-managed PAWs
For administering Entra ID and Microsoft 365, PAWs joined to Entra ID and managed by Intune are a common approach. Conditional Access can then require, for privileged roles, a compliant device identified by a device filter or a dedicated group. It is an effective way of binding cloud privileges to controlled devices.
This model has a direct consequence: Intune administrators who can change the configuration of these PAWs or push scripts to them effectively control the accounts that sign in on them. They must therefore be treated at the same level as the roles they give access to. For AD Tier 0, the same question applies to the PAW management tool: it must not be administrable from a lower tier.
Cloud-hosted virtual desktops can serve as PAWs for some uses, provided the same logic is respected: the physical device used to connect to them is part of the chain. Check the available options and their limits at the time of the project.
Starting realistically
There is no need to aim for a complete set-up for every administrator from day one. A reasonable progression is to equip Tier 0 administrators and cloud Global Administrators first, technically prevent Tier 0 accounts from signing in anywhere other than those devices, then extend to Tier 1.
What an audit checks
- The devices from which Tier 0 accounts actually sign in, according to the logs.
- Logon restrictions preventing these accounts from signing in to lower-tier systems.
- PAW hardening: application control, no email or browsing, local rights.
- The PAW management chain and the tier of the administrators who control it.
- Conditional Access policies binding privileged cloud roles to dedicated devices.
- Use of jump servers and the originating device of those connections.