The problem
Access that never sleeps
A standing privilege is a privileged access right that is always active: the domain administrator who can do anything in Active Directory, the database administrator with access to all customer data, the global administrator in Microsoft 365. The account was created because someone needed it for a task – but the privileges were never removed once the task was done.
Administrators do of course need elevated privileges. The problem is that the privileges are active 24 hours a day while they may be used for one hour a week. For the remaining 167 hours, they benefit only one group: the people trying to break in.
The risk
Why attackers go after them
- Always open: a stolen admin account works immediately – the attacker does not have to wait for or request anything.
- More than you think: assessments typically find far more accounts with elevated privileges than the organisation expects – including old test and consultant accounts.
- Shared and reused: shared admin accounts with passwords that circulate in teams and are never changed make it impossible to see who actually did what.
- They survive everything: privileges accumulate through job changes and projects and are rarely taken away again.
- Keys to the kingdom: with one domain administrator, an attacker can disable security tooling, erase traces and encrypt everything – that is how ransomware attacks escalate.
Just-in-time: access when it is used – and only then
The principle of just-in-time (JIT) access is simple: nobody holds standing privileged rights. When an administrator needs to perform a task, they request the privilege, receive it for a limited period – typically a few hours – and lose it again automatically. Approval can be automatic for routine tasks and require an additional approver for the most critical systems.
A PAM solution ties it together: passwords for privileged accounts are kept in a central vault and rotated after every use, sessions can be recorded, and every action can be traced back to a named person. The goal is what is often called zero standing privileges: the moment nobody is working, there are no active admin privileges to steal.
The gain is measurable. An attacker who lands in your environment finds no accounts that can be escalated straight away – and a privilege request in the middle of the night from an unusual location is an alarm signal, not a routine event.
Where should you start?
By mapping the privileged accounts you have today: who holds them, when they were last used, and which ones are shared. Experience shows that a large share can be decommissioned or downgraded immediately without anyone noticing.
Then introduce JIT for the most critical systems first – domain controllers, central databases and cloud administration – and expand gradually. Combined with individual accounts and logging, you have closed the gap that most serious attacks go through.
How many standing admin privileges do you have right now?
An IAM Healthcheck maps your privileged accounts and access and gives you a prioritised plan for removing standing privileges.
