# Should administrators use separate accounts for admin work?

Yes. An administrator who reads e-mail and browses the web with an admin account exposes the keys to everything to every phishing message and malicious website. With a separate admin account, used only for admin tasks and never for e-mail or browsing, a compromised everyday account gets the attacker much less. Go further where you can: require phishing-resistant MFA on admin accounts, use them only from a dedicated admin workstation or a bastion host, give each admin account only the rights for the systems it manages, and disable admin accounts that have not been used for months. This applies to your IT supplier's staff as well. It is identity hygiene that a network tool cannot enforce. It does make monitoring sharper, though: when admin sessions are expected only from one workstation or bastion, NetSenX flags admin protocols used from other hosts as lateral movement, on every plan.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/should-admins-use-separate-accounts-for-admin-work

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is privileged access management (PAM), and do we need it?](https://netsenx.com/en/faq/what-is-privileged-access-management)
- [Can network monitoring see attacks on accounts and the directory?](https://netsenx.com/en/faq/can-network-monitoring-see-identity-attacks)
- [Does NIS2 require zero trust?](https://netsenx.com/en/faq/does-nis2-require-zero-trust)
- [How do we limit what a compromised laptop can reach?](https://netsenx.com/en/faq/how-to-limit-what-a-compromised-laptop-can-reach)
- [Should our servers be allowed to connect to any address on the internet?](https://netsenx.com/en/faq/should-servers-be-allowed-to-browse-the-internet)