# Who holds admin rights in our company, and how do we check?

Usually more people and accounts than anyone thinks, so build the list from the systems themselves, not from memory. Check the administrator groups in your directory or cloud identity provider, the local administrators on PCs and servers, the admin roles in each cloud application such as e-mail, accounting and file sharing, the admin accounts of firewalls, switches, Wi-Fi and backups, and the accounts your IT supplier uses. Look for former staff, shared accounts, accounts that have not signed in for months and service accounts with admin rights. Then reduce: remove what nobody needs, give administrators a separate admin account, require phishing-resistant MFA on all of them, and repeat the review every quarter and whenever someone leaves. This is identity work, and a network sensor cannot list admin rights. NetSenX helps on the other side: it flags admin protocols used between hosts in ways that do not match their normal as lateral movement, on every plan.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/how-to-find-out-who-has-admin-rights

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What does least privilege mean in practice?](https://netsenx.com/en/faq/what-is-least-privilege-in-practice)
- [Do service accounts and API tokens need monitoring too?](https://netsenx.com/en/faq/do-service-accounts-and-api-tokens-need-monitoring)
- [Are shared admin accounts a problem, and what should we do instead?](https://netsenx.com/en/faq/how-to-handle-shared-admin-accounts)
- [Are password managers safe for a company to use?](https://netsenx.com/en/faq/are-password-managers-safe-for-a-company)
- [What makes a good company password policy?](https://netsenx.com/en/faq/what-makes-a-good-company-password-policy)