implementing-privileged-access-workstation

# Implementing Privileged Access Workstation ## Overview A Privileged Access Workstation (PAW) is a hardened device dedicated to performing sensitive administrative tasks. This skill covers PAW design using the tiered administration model, device compliance enforcement via Microsoft Intune or Group Policy, just-in-time (JIT) access provisioning, and integration with privileged access management (PAM) platforms like CyberArk and BeyondTrust. ## When to Use - When deploying or configuring implementing privileged access workstation capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation ## Prerequisites - Windows 10/11 Enterprise with Virtualization Based Security (VBS) - Microsoft Intune or Active Directory Group Policy - CyberArk Privileged Access Security or BeyondTrust Password Safe (optional) - Python 3.9+ with `requests`, `subprocess`, `json` - Administrative access to target endpoints ## Steps 1. Audit current privileged access patterns and identify Tier 0/1/2 assets 2. Configure device hardening baselines (AppLocker, Credential Guard, Device Guard) 3. Enforce compliance policies via Intune or GPO 4. Implement just-in-time access with time-limited admin group membership 5. Integrate with CyberArk/BeyondTrust for credential vaulting 6. Validate PAW configuration against CIS and ...