What is the principle of least privilege?
Least privilege is a rule for handing out permissions. Before granting a right, you ask what the person, service or program actually needs, grant that, and leave everything else off. It applies to user accounts, groups, service accounts, applications and IT staff alike. On the A+ exam it is the usual answer when a scenario asks how to limit the damage from a user mistake, a stolen password or malware.
Why it limits damage
Assume any account can be compromised. When it is, the attacker, or the malware running under that account, inherits exactly what the account can do. Least privilege does not prevent the compromise; it shrinks what happens next:
- Malware running as a standard user can damage that user's profile, but it cannot silently install drivers, turn off security tools for the whole machine or create new administrator accounts.
- Ransomware on an account with read-only access to a shared folder can read those files but cannot encrypt or delete them.
- A user who cannot change system settings cannot break them by accident.
How it is applied on a Windows workstation
- Standard accounts for daily work. Users sign in as members of the Users group, not Administrators. People who do admin work keep a separate administrator account and use it only for that work.
- Elevate on demand. User Account Control (UAC) stops a program that wants admin rights and asks for consent or admin credentials. Leaving UAC on turns a silent privilege grab into a visible decision.
- Narrow file and share permissions. Grant Read rather than Modify or Full Control unless the job requires changes. When NTFS and share permissions both apply, the more restrictive result wins.
- Remove what is no longer needed. Keep the Guest account disabled, disable or rename the built-in Administrator, remove stale accounts and review group membership when people change roles or leave.
- Apps and services too. A service account should hold only the rights its service needs, and a phone app should get only the permissions that match its purpose.
Models that put it into practice
- Role-based access control (RBAC): rights are assigned to groups that match job roles, such as HR-Read and HR-Edit, and users join the role. This keeps least privilege manageable and makes onboarding and offboarding a matter of group membership.
- Just-in-time (JIT) access and privileged access management (PAM): admin rights are granted for a short window after approval, with logging, instead of sitting on an account all day.
- Zero Trust: no request is trusted just because it comes from inside the network. Zero Trust decides whether a request is allowed; least privilege decides how much access it gets.
Least privilege vs. look-alike terms
| Term | Question it answers |
|---|---|
| Authentication | Who are you? (password, PIN, biometrics, MFA) |
| Authorization | What may you do once you are signed in? (permissions, roles, ACLs) |
| Least privilege | How much authorization should you get? (the minimum the task requires) |
Principle of least privilege on the CompTIA A+ exam
Least privilege appears in Core 2 (220-1202) objective 2.1 as a logical security control and in objective 2.7 as a workstation best practice for restricting user permissions. Expect scenarios such as a user who keeps installing unapproved software, a technician who wants domain admin rights "to save time," or a vendor whose backup agent asks for full access. The right answer grants only what the task needs: a standard account, a role-based group, a time-limited elevation or a dedicated account with minimal rights. If you see "limit what malware can do" or "users should not change system settings," think least privilege and standard user accounts. Making the user a local administrator or turning off UAC to stop the prompts is the wrong answer.