Just as the CEO's workstation should receive special attention, so should the administrator's workstation. The CEO and other executive staff have documents which must be protected against loss or exposure. The administrator's workstation is a prime target for hackers. The hacker who gains admin access to the domain administrator's workstation can use numerous approaches to leverage this local access to acquire domain level access. Examples of poor workstation practices and techniques used by hackers follow.
Administrators tend to minimize the number of passwords they have to remember.
They tend to use the same passwords where they can. Hackers take advantage of the dangerous admin practice of using the same password for their workstation admin account and their domain admin account. A hacker can run a dictionary attack against the workstation's administrator account password, and use that password as a starting point for attacks against the domain admin account. The default configuration for the built-in administrator account allows unlimited password guessing, permitting a dictionary attack against the account. The NT Resource Kit utility, Passprop , changes the local workstation's security policy so that the built-in admin account will conform to the account lockout policy of the workstation.