Privileged Access Workstation (PAW)
A privileged access workstation (PAW) is a dedicated, hardened computer used only for administrative work, with no email, no general web browsing and only approved applications, so that a phishing email or malicious website cannot reach the device that holds admin credentials. Microsoft's privileged access guidance calls it "the highest security configuration designed for extremely sensitive roles."
Microsoft defines three device levels, and the PAW is the top one:
| Control | Enterprise | Specialized | Privileged (PAW) |
|---|---|---|---|
| Web browsing | Allow most | Allow most | Deny by default, admin portals only |
| Email and productivity apps | Yes | Yes | No, on a separate device |
| User is local admin | Allowed | No | No |
| Application control (AppLocker) | None | Audit, then enforced | Enforced |
| BYOD enrollment | Allowed | Denied | Denied |
A PAW also relies on a hardware root of trust (TPM 2.0, Secure Boot, BitLocker) and Windows protections such as Credential Guard. The reason is the clean source principle: an admin session is only as trustworthy as the device it starts from, because an attacker who controls that device can steal the admin's tokens or act as them.
A PAW is not a jump server or bastion. A jump server is an intermediary that admins connect through; a PAW is the device they connect from, and a compromised laptop connecting to a perfect bastion still hands the attacker the session. The cost is real: admins need two devices or a separate hardened virtual environment, which is why many organizations limit PAWs to tier-zero roles (domain, identity provider and cloud tenant admins) and pair them with device posture checks in conditional access so admin portals refuse sign-ins from anything else.
See also: top privileged access workstations, PAM, session recording, privileged remote access, primary refresh token theft
Related on Start with Identity
- GlossaryStanding Privilege
Standing privilege is elevated access (an admin role, a privileged group membership, a cloud owner permission) that an account holds permanently, whether or not
- GlossaryZero Standing Privileges
Zero standing privileges (ZSP) is an access model in which no human or machine identity holds permanent elevated rights: every privilege is granted [just in tim
- GlossaryJust-in-Time (JIT) Access
Granting elevated permissions only when needed, for a limited duration, and revoking them automatically. JIT eliminates [standing privilege](/glossary/standing-
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM