Here is an overview how the process works: Prerequisites That's the problem you're going to learn how to solve in this guide. You need an automated way to not only remove privileges from that account but also to request and approve that request in the first place.

You might think you'll remember to remove that account but you probably won't. You could just add that engineer's account to the Domain Admins group which solves the problem but the engineer only needs those rights temporarily. For example, perhaps an engineer needs the same privileges that a member of the Domain Admins group needs.

This solution the guide will cover will manage the requirement of temporary elevated access of various resources controlled by AD groups.

It will allow you and your peers to practice privileged account management (PAM) on the cheap to get the job done. In this article, you're going to learn a quick way of managing high-privilege accounts using tools you probably already have in your environment. Commercial tools are good solutions but implementing them can be complicated and will incur some costs. There are many solutions available to manage high-privilege accounts like Microsoft Identity Manager (MIM), for example. Did you get an IT audit and was told you have too many super users in your Active Directory domain? Or perhaps you have read a recent breach and they were talking about limiting admin access when not in use?

Nine for office 365 need admin approval