Guide
Administrator accounts, passwords and two-factor authentication
Administrator accounts are the keys to your IT: an attacker who gets hold of one can do anything. Separate accounts, two-factor authentication, strong passwords: here are the ANSSI and CNIL rules, boiled down to what an SME needs to do.
Updated on 18 October 2026 · Figures are sourced at the bottom of the page; opinions are those of IT CyberWall.
Why these accounts are the target
An attacker who obtains the password of an administrator account can do anything: install ransomware on every workstation, erase data, create accounts to come back later. Protecting these accounts is the measure that most reduces the potential damage. ANSSI devotes several measures of its IT hygiene guide to it: inventory of privileged accounts, separation of user and administrator roles, strong authentication[1].
Separate administrator accounts
- An administrator account separate from the everyday account, with a different password[2].
- Never use email or browse the web with an administrator account[2][1].
- Named accounts: you know who did what[2][1].
- Least privilege: everyone has only the rights they need, and users are not administrators of their own workstation[2][1].
- An up-to-date inventory of privileged accounts, including those of providers[1].
Two-factor authentication
ANSSI recommends favouring multi-factor authentication[3] and requiring at least two factors for administration[2]. In practice, start with:
- administrator accounts (Microsoft 365, Google Workspace, servers, firewall, hosting provider, domain name);
- remote access (VPN, remote desktop);
- email for all users.
An authenticator app or a security key is better than a code received by SMS, which is easier to intercept.
Passwords that hold up
| Case | CNIL recommendation[4] |
|---|---|
| Password only | 12 characters with upper case, lower case, numbers and special characters, or 14 characters with no special character required, or a passphrase of 7 words |
| Account protected by lockout after several failed attempts | 8 characters of 3 different types, or 5 words |
- No forced renewal for everyone: the CNIL and ANSSI no longer require it for ordinary accounts, but keep it for privileged accounts[4][3].
- An immediate change if a compromise is suspected[3].
- A password manager provided by the company[3].
- Default passwords on internet boxes, printers, cameras and servers are changed as soon as they are installed[3][1].
Your checklist
- Who is administrator of what? The list exists and is up to date.
- No administrator reads their email with their administrator account.
- Two-factor authentication is active on all administrator accounts and remote access.
- Accounts belonging to former employees and former providers are disabled.
- The « owner » account for your Microsoft 365 or Google Workspace and your domain name is in the company’s name.
What IT CyberWall does
We inventory privileged accounts, separate administrator accounts, enable two-factor authentication and set up a password manager. Our own access to your systems is through named accounts, and you keep the list.
Lost track of who is administrator of what?
We inventory your accounts and set up two-factor authentication.
Sources
Sources consulted on 18 October 2026. Supplier prices are shown excluding tax, in the currency and region of the published price list, and may change: always check the official page before deciding.
- ANSSI – Guide d’hygiène informatique, v2.0 (measures 5, 8 to 13, 27 to 29) — messervices.cyber.gouv.fr/documents-guides/guide_hygiene_informatique_anssi.pdf
- ANSSI – Recommendations to Secure Administration of IT Systems, v2.0 (24 April 2018) — cyber.gouv.fr/sites/default/files/2018/10/guide_anssi_secure_admin_is_pa_022_en_v2.pdf
- ANSSI – Recommandations relatives à l’authentification multifacteur et aux mots de passe, v2.0 (8 October 2021) — messervices.cyber.gouv.fr/guides/recommandations-relatives-lauthentification-multifacteur-et-aux-mots-de-passe
- CNIL – Délibération n° 2022-100 du 21 juillet 2022, recommandation relative aux mots de passe — www.cnil.fr/sites/cnil/files/atoms/files/deliberation-2022-100-du-21-juillet-2022_recommandation-aux-mots-de-passe.pdf