Which of the following is the MOST important reason to limit the number of users with local admin privileges on endpoints?

The most critical reason to limit local admin privileges is to reduce the attack surface and mitigate the impact of a compromise. Threat actors actively seek to compromise privileged accounts. If an attacker gains control of an account with local admin rights, they can bypass security controls, install persistent malware (e.g., rootkits), access sensitive data, and use the compromised machine to move laterally across the network. This elevates a minor intrusion into a significant breach. This aligns with the principle of least privilege, a cornerstone of modern cybersecurity strategy.

A. While true, installing unapproved software is a symptom of the larger, more critical security risk that an exploited admin account can be used for malicious purposes.
C. Administrative overhead is an operational concern, not the primary security reason. The security benefit of mitigating major breaches far outweighs the administrative effort.
D. Making unauthorized changes is a risk, but it is less severe than the risk of a threat actor exploiting the account for a full system compromise and network pivot.

1. National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. Control AC-6: Least Privilege. Page 58. https://doi.org/10.6028/NIST.SP.800-53r5

2. MITRE. (2023). ATT&CK Enterprise Matrix, T1068: Exploitation for Privilege Escalation. This technique details how adversaries exploit system weaknesses to gain higher-level permissions, highlighting the danger of available privileged accounts. https://attack.mitre.org/techniques/T1068/