logoalt Hacker News

XorNot04/23/20254 repliesview on HN

It's the same as domain admin in active directory.

You always need it to setup the system initially.

It's like root on Linux: it's an implementation detail that it must be possible.


Replies

lovehashbrowns04/23/2025

There’s no possible need for an admin-level user that bypasses logging. If anything these users should have additional logging to external systems to make it harder to hide their use.

tw0404/23/2025

Root on Linux isn’t exempt from logging. I also don’t know any enterprise that allows admin accounts to bypass logging.

There is no legitimate justification for this request.

show 1 reply
sanderjd04/23/2025

The question is whether it needs to be possible to turn off the audit logs for that role. And of course: No.

skeeter202004/23/2025

typically the admin account can createthings like super users, and super users can do anything with the data, but not sure there's a use case where a single account can do both, and why can any of them avoid logging?