PAWs, Separate Administrator Accounts, and Session Discipline: A Trusted Management Path.

1. Core mechanism

Lesson 14.01 establishes plane separation; this lesson applies it to an operator's daily work. A PAW is a highly trusted administration device that limits productivity tools and local administrative access for extremely sensitive roles. A separate administrator account separates privileged work from the everyday user identity. Session discipline makes it visible and auditable which account connected from which source device to which target and with what logon type. The aim is not only to reduce credential-theft risk, but also to enforce clear source and target boundaries for high-impact sessions.

Interfaces and specifications

• A PAW is a hardened workstation limited to the applications required for sensitive administration; productivity web and email use stays on a separate account and device.
• A separate administrator account is used only for high-impact administration; the everyday user account handles email, web, and collaboration.
• The source-device boundary limits the devices from which an administrator account may sign in to approved PAW devices.
• The target boundary allows a PAW to reach only approved endpoints in the plane being administered.
• The session boundary gives each interactive administration session a distinct logon identity and correlation key; shared accounts weaken that link.
• For a successful logon, Windows event 4624 can include TargetUserName, TargetDomainName, TargetLogonId, LogonType, and version-dependent fields such as WorkstationName and IpAddress.
• LogonType 10 means a RemoteInteractive session through Remote Desktop or Terminal Services; it does not mean that the session is elevated or secure.

What a PAW reduces

A PAW keeps the credentials and session material of a high-impact account within a smaller attack surface. Microsoft's privileged-access device guidance describes a PAW profile that restricts local administrative access and productivity tools. It also separates email and web browsing, which are common phishing paths, onto distinct accounts and workstations.

This makes a PAW more than an ordinary corporate laptop with a different name. If general web access, email, developer tools, and a control-plane administrator session coexist on one device, the trust path is not separated even if the device is physically distinct.

Why separate accounts matter

An everyday user account has regular exposure to external content, collaboration, and productivity services. Giving that same identity control-plane privileges directly connects this broad user surface to a high-impact role. A separate administrator account places the two risk areas under different policy, MFA, logon-restriction, and monitoring profiles.

A separate account does not mean a shared account. Each operator should have a personal administrator identity; otherwise, it becomes harder to attribute a logon session to an operator, remove access when they leave, and establish a behavior baseline.

Session discipline answers three questions

Record three pieces of context for every administration session: which account, which source device, and which target host. Adding the logon type and the target's TargetLogonId turns a vague statement such as 'the admin account was used' into a concrete session path.

Event 4624 provides only part of that path. LogonType 10 identifies a RemoteInteractive session; by itself, it does not prove that the connection came from a PAW or reached the correct target. Validate WorkstationName and IpAddress in context because network topology, forwarding, or missing values can affect them.

Closing a session does not remove an account's privileges

A Windows access token is created at logon and carries user and group SIDs. An open session therefore represents an authorization context at a particular time. Closing the session when administration is complete prevents that context from remaining open on the target unnecessarily, but it does not remove the account's directory permissions.

The reverse is also true: removing an account from a group does not prove that every already-created session changed immediately. Incident response must handle account state and active session/token state separately.

State and data flow

1. The operator does everyday work with a standard user account on a productivity device.
2. When control-plane work is needed, the operator moves to a separate PAW and does not open email or general web sessions on it.
3. The operator authenticates on the PAW with a personal administrator account; shared administrator accounts are not used.
4. PAW network policy permits only approved administration targets and required identity/update services.
5. The operator connects to an approved management endpoint. If the target host records a successful logon in event 4624, TargetLogonId can help correlate related session events on that host.
6. When work is complete, the target administration session is closed; the administrator account is not used for productivity work.
7. The blue team compares administrator account, source workstation, target host, and logon type with the expected path profile.
8. Review sessions from unexpected source devices or targets; event 4624 alone does not prove that privileges were used or that a session was malicious.

2. Exploitation

Broken trust assumption

The broken assumption is that buying a separate PAW or giving an administrator account a different username automatically creates a trusted management path.

Technical prerequisites

• A high-impact administrator account is accepted on a source device other than a PAW, or productivity exposure is present on the PAW.
• An allowlist or plane-aware access restriction between the source device and target host is missing.
• The administrator identity is shared, or session telemetry cannot be attributed to an operator.
• Successful logons are not baselined with account, source device, target, and logon-type context.

Exploitation mechanism

An attacker targets a point where the trusted path is mixed. If an administrator account is used on a low-trust productivity device, that device can expose high-impact credentials or session material. Opening web or email on a PAW brings phishing exposure onto it. A shared administrator account weakens session attribution. Connecting from a PAW to an unapproved lower-plane target makes that target a new exposure surface for high-impact session material. The controls are meaningful only when account, device, target, and session boundaries work together.

The weakest end of the path

A hardened target does not make an administrator session from an untrusted source device safe. Credentials or session material can be exposed on the source device before reaching the target. A trusted management path depends on the security of its starting device as well as its target.

Likewise, a hardened PAW does not make every target the administrator connects to safe. Connecting with a high-impact account to a lower-plane or unmanaged target turns that target into another credential-exposure boundary.

Separation cannot be verified without telemetry

A policy document can say that administrator accounts are used only on PAWs, but that rule cannot be shown to be enforced unless successful logons are tracked by source workstation and target host.

The 4624 artifact shows only this limited evidence: a successful RemoteInteractive logon recorded on a particular host. It does not prove the account's business purpose, that the device is actually hardened, or that only approved actions occurred during the session.

3. Defense & Detection

Telemetry scope

• Inventory administrator accounts by person, the plane they may manage, and the PAW devices they are allowed to use.
• Record successful administrator logons with source workstation, source IP, target host, LogonType, and TargetLogonId.
• Monitor logons from administrator accounts on productivity endpoints, devices with email/web access, and unapproved targets as separate violation types.
• Avoid shared or ownerless administrator identities; put break-glass accounts in a separate usage and review process.
• Treat open administration sessions and account privileges as separate datasets.

Events and relevant fields

• A successful 4624 event provides core session context through TargetUserName, TargetDomainName, TargetLogonId, and LogonType.
• LogonType 10 identifies a RemoteInteractive connection; it does not establish an elevated token, use of privileges, or PAW compliance.
• TargetLogonId can correlate related session events such as 4672 on the same host; it is not a global session ID across hosts.
• WorkstationName and IpAddress add source context, but empty, local, or proxy-influenced values must be assessed in the environment.

The expected path profile

Detection is not a list of Event IDs. Define the expected source PAWs, target plane, and permitted logon types for each administrator identity. Event 4624 becomes useful when compared with this profile: a successful logon by the same account from an unapproved workstation or to an unapproved target is a reviewable deviation.

The artifact shows adm-tunahan connecting from PAW-01 to ADM-JUMP-01 with LogonType 10. It teaches the event format and correlation fields; it is not a real allowlist, real user, or proof that a control succeeded.

Account state and session state are separate

Disabling an administrator account or removing it from a group changes directory state. Whether sessions remain open on particular targets must be measured separately. Incident containment cannot be considered complete without reconciling both datasets.

For the same reason, closing a session alone does not remove persistent privileges. Least privilege treats account entitlement and active-use context as separate controls.

Detection logic · XPath

*[System[EventID=4624] and EventData[Data[@Name='TargetUserName']='adm-tunahan' and Data[@Name='LogonType']='10']]

Query assumptions

• This selector combines System and EventData predicates on the same event node and targets the Security log's 4624 schema.
• adm-tunahan is a synthetic example account; replace it with the production account inventory.
• Validate PAW compliance separately by correlating WorkstationName and IpAddress with the device inventory.

False positives

• Planned Remote Desktop administration from an approved PAW is an expected match.
• Break-glass use may be authorized by an incident record.
• WorkstationName or IP values may be missing or indirect indicators of the source device.

Hardening

• Use a personal administrator account for each high-impact role; do not grant the same privileges to the everyday productivity account.
• Restrict administrator-account logons to approved PAW source devices and approved targets in the plane being managed.
• Do not run email, general web browsing, or unnecessary productivity tools on a PAW.
• Manage local-administrator access, application allowlisting, disk encryption, and device-security controls as part of the PAW profile.
• Close target sessions when administration is complete; verify active-session inventory separately from directory account state.

Read the examples

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}"/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2026-10-01T08:14:23.0000000Z"/><EventRecordID>1402001</EventRecordID><Correlation/><Execution ProcessID="708" ThreadID="912"/><Channel>Security</Channel><Computer>ADM-JUMP-01.outreason.example</Computer><Security/></System><EventData><Data Name="SubjectUserSid">S-1-5-18</Data><Data Name="SubjectUserName">ADM-JUMP-01$</Data><Data Name="SubjectDomainName">OUTREASON</Data><Data Name="SubjectLogonId">0x3e7</Data><Data Name="TargetUserSid">S-1-5-21-111111111-222222222-333333333-2102</Data><Data Name="TargetUserName">adm-tunahan</Data><Data Name="TargetDomainName">OUTREASON</Data><Data Name="TargetLogonId">0x14a02</Data><Data Name="LogonType">10</Data><Data Name="LogonProcessName">User32</Data><Data Name="AuthenticationPackageName">Negotiate</Data><Data Name="WorkstationName">PAW-01</Data><Data Name="LogonGuid">{14020000-0000-0000-0000-000000000001}</Data><Data Name="TransmittedServices">-</Data><Data Name="LmPackageName">-</Data><Data Name="KeyLength">0</Data><Data Name="ProcessId">0x2c4</Data><Data Name="ProcessName">C:\Windows\System32\svchost.exe</Data><Data Name="IpAddress">192.0.2.41</Data><Data Name="IpPort">53314</Data><Data Name="ImpersonationLevel">%%1833</Data><Data Name="RestrictedAdminMode">-</Data><Data Name="TargetOutboundUserName">-</Data><Data Name="TargetOutboundDomainName">-</Data><Data Name="VirtualAccount">%%1843</Data><Data Name="TargetLinkedLogonId">0x0</Data><Data Name="ElevatedToken">%%1842</Data></EventData></Event>

Two reality checks

Assumption: A PAW is a normal corporate laptop with a new name and administrator tools installed.

In fact: A PAW profile restricts local administrative access and productivity tools; email and general web browsing use separate accounts and workstations. Its security value comes from this attack-surface separation.

Assumption: A 4624 LogonType 10 proves that a session came from a PAW, was elevated, and was secure.

In fact: LogonType 10 identifies only a RemoteInteractive session. Verify PAW compliance against source-device inventory, privilege context with the relevant fields or events, and authorization with a work record.

Sources

• Microsoft · Why are privileged access devices important
  Privileged Access Workstation guidance: highest security configuration for sensitive roles; restricted local administration and productivity tools; separation of email/web browsing and productivity accounts/workstations.
• Microsoft · 4624(S) An account was successfully logged on
  Event Version 2 example; TargetUserName, TargetDomainName, TargetLogonId, WorkstationName, and IpAddress field descriptions; Logon Type 10 is RemoteInteractive.
• Microsoft · access tokens
  Access-token contents and creation during logon; tokens represent an authorization context for a session.
• Microsoft · Consuming Events (Windows Event Log)
  Windows Event Log XPath subset and selector rules: selectors must select event nodes; predicates can combine System and EventData conditions on the same event.