Why is a single desktop-deployment credential a wider attack channel than a domain administrator account across 900 stores?

## Two kinds of power that are not the same When people rank access, domain administrator sits at the top, so the instinct is to treat it as the widest possible key. But 'widest' has two meanings that come apart under this leaf: **authority** (what you are permitted to do) and **reach** (how many hosts you can affect, how fast). Domain admin maximises authority. A deployment path maximises reach. For an intruder whose goal is a coordinated, timed effect across an estate, reach is what matters. ## How domain admin actually touches a host Domain admin can run code on any member host — but it still has to **get there**. To affect a machine, a domain admin connects to it through one of the per-host channels: the administrative share and service creation, WMI, a WS-Man shell, or RDP. Each is a round trip to one host. Affecting 900 tills means 900 such operations, assembled and driven one at a time. The authority is total; the reach is serial. ## How a deployment path touches a host A desktop-deployment path exists to solve exactly the problem domain admin does the hard way: get software onto every machine. Its agent is **already installed, trusted, and listening** on each host, and it **executes what it is pushed as a privileged local account** (commonly SYSTEM or a local administrator). So a single push, authenticated by one deployment credential, fans out to the whole fleet in one operation. The reach is parallel and estate-wide by design. ## Why the deployment credential is the wider channel Put the two side by side: - **Domain admin:** unlimited authority, but reach is assembled host by host through the per-host channels. - **Deployment credential:** need not be a directory administrator at all, yet yields one-operation code execution on every host the agent covers. So the deployment credential can deliver something domain admin cannot without extra work: **simultaneous** reach. That is precisely the counterintuitive point to make to a desktop-deployment team who think of their push account as 'low privilege'. Its directory rank is modest; its reach is the entire estate, at once. It is a wider attack channel than the account everyone guards most carefully. ## Why this fits a deadline crew, not a patient one A crew working to a **publicity deadline** wants a coordinated, timed effect — every till at once — not stealth or long dwell. That goal rewards the fan-out channel and punishes the per-host channels, which are slow across 900 sites, and punishes RDP twice over because interactive logons also deposit the credential on every host reached. The deployment path is the natural instrument for simultaneous reach, which is why an intruder who already holds estate-wide privilege will still specifically hunt the deployment credential. ## What this predicts The practical takeaway: **scope of reach, not directory rank, decides how wide a credential is.** Any account that an already-listening, estate-wide agent will execute on behalf of is, in reach terms, at least as dangerous as domain admin — and easier to under-rate, because it does not carry an obviously frightening name.