# Are shared admin accounts a problem, and what should we do instead?

Yes. When several people use one admin account, nobody can tell afterwards who did what, the password is rarely changed when someone leaves, and multi-factor authentication is hard to bind to one person, so the account often goes without it. Give each administrator, including your IT supplier's staff, a personal admin account with phishing-resistant MFA, and remove or disable the shared one. Where a built-in account cannot be removed, such as the local administrator on PCs or the emergency account of a firewall, give each machine a unique random password managed by a tool, keep emergency credentials sealed, and alert when they are used. Log admin actions per person and review the list of admin accounts every quarter. A network sensor cannot tell which person used an account. NetSenX shows from which host admin sessions start and flags sessions that do not match a host's normal as lateral movement, on every plan, so a shared account used from an odd machine stands out.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/how-to-handle-shared-admin-accounts

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Are password managers safe for a company to use?](https://netsenx.com/en/faq/are-password-managers-safe-for-a-company)
- [What makes a good company password policy?](https://netsenx.com/en/faq/what-makes-a-good-company-password-policy)
- [What is single sign-on, and does it improve security?](https://netsenx.com/en/faq/what-is-single-sign-on-and-does-it-improve-security)
- [How do we monitor an external accountant's remote access to our PCs?](https://netsenx.com/en/faq/how-to-monitor-an-external-accountants-remote-access)
- [What happens if our outsourced IT provider or bookkeeper is hacked?](https://netsenx.com/en/faq/what-happens-if-our-outsourced-it-or-bookkeeper-is-hacked)