What is administrator access?¶
Administrator access is access with authority to make significant changes to a device, application, account environment or service.
Avoid the dangerous assumption¶
The dangerous assumption is that administrator access is one universal level of complete control.
It is not.
Different environments use different roles.
An administrator may control:
- one device
- an application
- a cloud tenant
- a database
- an identity platform
- a network
- a security product
- a limited set of functions.
Investigators should identify the exact role and scope.
Ask:
- which account held the privilege
- what systems it could control
- whether the privilege was permanent or temporary
- how the user authenticated
- whether approval was required
- which actions were performed
- whether the access was delegated or automated.
A person may hold several administrator roles with different authority.
Likewise, a service account or application may have administrative permissions without an interactive human user.
Do not assume that an administrator account holder performed every action recorded against that account.
Shared use, compromise, remote control and automation remain possible.
Administrator access can be legitimate but still misused.
The evidential question is whether the action was authorised, proportionate and consistent with role and purpose.
Preserve role assignments, permission changes, sign-in records, session data and administrative audit logs.
Where privileged access is temporary, preserve activation, approval and expiry records. A time-limited role may explain why an account could perform an action during one period but not before or afterwards. This can materially narrow the incident timeline.
Operational takeaway¶
Define the exact administrative role, scope and session involved, and do not equate an administrator account with the personal identity of the actor.