Who holds admin rights in our company, and how do we check?

Usually more people and accounts than anyone thinks, so build the list from the systems themselves, not from memory. Check the administrator groups in your directory or cloud identity provider, the local administrators on PCs and servers, the admin roles in each cloud application such as e-mail, accounting and file sharing, the admin accounts of firewalls, switches, Wi-Fi and backups, and the accounts your IT supplier uses. Look for former staff, shared accounts, accounts that have not signed in for months and service accounts with admin rights. Then reduce: remove what nobody needs, give administrators a separate admin account, require phishing-resistant MFA on all of them, and repeat the review every quarter and whenever someone leaves. This is identity work, and a network sensor cannot list admin rights. NetSenX helps on the other side: it flags admin protocols used between hosts in ways that do not match their normal as lateral movement, on every plan.

← All 45 questions on Zero trust, identity and segmentationAll topics