Admin Rights

An administrator, often called an admin, can manage other accounts and change who has access. If an attacker steals an admin account, they may be able to create more accounts for themselves. That is why admin access should be limited to people who need it.

For example, suppose Dana was given admin access but does not need it for her work. Remove her from the admins group:

seclab remove dana admins

You should see:

Removed dana from admins.

Dana's account stays active, and her other groups stay unchanged. A new employee does not need admin rights just to start work either. For a trainee joining the roastery, approve the account first, then add the group for the job:

seclab approve trainee

You should see:

Approved trainee. The account is active.

seclab add trainee roastery

You should see:

Added trainee to roastery.

The trainee can now sign in and do their work without being able to manage everyone else's accounts.