Where Administration Happens
A privileged session from a compromised laptop is a compromised privileged session. The dedicated-device control, and cheaper approximations.
Analysis
Controls on the target system do nothing if the device initiating the session is under someone else's control.
The problem
An administrator's workstation runs email and a browser, which are the two most common initial access routes.
A compromised workstation observes everything the administrator does, including credentials typed and sessions established.
Multi-factor authentication does not help once a session is established on a compromised device.
Session recording does not help either — it records the attacker's actions as though they were the administrator's.
This is the gap that most PAM deployments leave open.
The full control
A dedicated administrative device.
Used only for administrative work.
No email, no general browsing, no arbitrary software.
Restricted network access, reaching management interfaces and the broker only.
Hardened, with application control and minimal installed software.
Tier-matched: tier zero administration only from tier zero devices.
Effective, and expensive in hardware, logistics and inconvenience.
Cheaper approximations
Where full deployment is not affordable, in rough order of value.
Apply it to tier zero only. Smallest population, largest consequence, and it captures most of the benefit.
Brokered sessions, so the credential never reaches the workstation even if it is compromised.
A dedicated virtual desktop for administrative work, which removes the hardware cost and keeps most of the separation.
Separate administrative accounts used only for administration, so ordinary phishing does not land in a privileged context.
Application control on administrative workstations, without full dedication.
Blocking email and browsing from administrative sessions specifically.
What to enforce
Logon restrictions so tier zero accounts can only authenticate from tier zero devices, enforced technically.
Device attestation at the broker, so a session cannot be established from an unmanaged device.
No credential storage on administrative accounts.
Session termination on disconnect rather than idle sessions persisting.
The virtual desktop option
The pragmatic middle path for many organisations.
A dedicated administrative desktop, delivered virtually, non-persistent.
Rebuilt per session, which removes persistence for an attacker.
Access restricted to the same management network as a physical dedicated device would be.
Cheaper than dedicated hardware and it depends on the virtualisation platform being at least as trusted as the systems administered from it, which is a real consideration.
The objection, and the answer
Administrators resist this more than any other control, and the objection is legitimate: it makes their work slower.
Acknowledge that plainly.
Reduce the friction: fast switching, a good remote experience, the tools they need available on the device.
Involve them in the design, because they know which workflows will break.
Apply it where it matters rather than universally, which is both cheaper and more defensible.
A control that makes work impossible will be bypassed, and a bypassed control is worse than none because it is believed to be in place.
The virtual desktop compromise
The pragmatic middle path when dedicated hardware is unaffordable.
A non-persistent administrative desktop, rebuilt per session.
Restricted to the management network, as a physical dedicated device would be.
No email or general browsing.
Application control applied.
Cheaper than hardware and it makes the virtualisation platform a dependency of your administrative security, which needs to be at least as trusted as the systems administered from it.
Acceptable for tier one; consider dedicated hardware for tier zero, where the platform dependency matters most.
Device attestation at the broker
The control that makes the workstation policy real rather than aspirational.
The broker checks device identity and posture before establishing a session.
Unmanaged devices are refused, not warned.
Tier zero sessions require a tier zero device.
Requires device identity to be reliable, which means certificate-based rather than name-based.
Test the failure mode: what happens when attestation is unavailable. Fail closed is correct and needs a break-glass route, or the first attestation outage becomes a permanent exception.