Topic starter
21/08/2026 4:51 pm
TL;DR: Shared administrative credentials, insecure remote access, and weak auditability leave SMB privileged access exposed, according to Devolutions. The control gap is not just password storage but governance over who can use elevated access, when, and under what traceable conditions.
Editorial analysis by NHI Mgmt Group, based on content published by Devolutions: “White papers”.
Key questions
Q: What breaks when SMBs rely on standing privilege for administrators?
A: Standing privilege creates persistent exposure that outlives the original task, especially in small teams where admins wear multiple hats.
Q: Why do shared admin rights and exposed remote access increase breach risk?
A: They combine two weak points: a credential that can be reused and a pathway that can be intercepted or attacked remotely.
Q: What are the signs that privileged infrastructure access is poorly governed?
A: Common signs include unmanaged admin interfaces, inconsistent ownership of firewall or router consoles, direct internet exposure, and patch state that is tracked separately from privileged access records.
Practitioner guidance
- Replace shared admin use with brokering Use a PAM workflow that issues privileged access without revealing the underlying password to each operator.
- Constrain remote admin channels Harden RDP and similar remote management paths so that exposed internet-facing access, brute force, and man-in-the-middle exposure are materially reduced.
- Record privileged sessions end to end Capture who requested access, who approved it, where the session ran, and what changed during the session.
Bottom line: Shared administrative access creates a governance problem because it removes the direct link between a person, a privilege, and an action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:09 pm
Shared admin rights are an identity governance failure, not a convenience pattern. SMBs often keep shared elevated accounts because the operational burden of delegating every task feels too high. That trade-off removes individual accountability and makes privilege review largely meaningless because the same credential can be used by multiple people. The implication is simple: shared access turns privileged work into an attribution problem before it becomes a technical one.
A few things that frame the scale:
- 61% of organisations still define privileged users as humans only, overlooking the role of non-human identities in privileged access, according to KPMG.
A question worth separating out:
Q: Should organisations use shared admin accounts or named privileged users?
A: Named privileged users are easier to govern because actions can be tied to a person, but they still need controlled issuance, MFA, and logging to be safe. Shared accounts may be easier operationally, yet they weaken accountability and make incident recovery harder. The better question is whether the team can prove who used access and what they did.
👉 Read our full editorial: Privileged access management for SMBs still breaks on shared admin rights