Skip to content Skip to site navigation

Privileged Access Workstation (PAW) User Guide

Cardinal Protect Notes:

  • No new Ring 1 PAWS will be provisioned.
    • Your department is responisble for providing a physical device for Cardinal Protect and must be under Warranty.  No old systems are accepted.  
    • Cardinal Protect for macOS is available now on Physical Hardware
    • Cardinal Protect for Windows on VDI is available now
    • If you are in Enterprise Technology (ET)  a Cardinal Protect VDI will be provided free of charge.
    • Windows Cardinal Protect VDI free of charge till the end Dec 2022 for anyone that qualifies for a PAW.
    • Starting Jan 2023 the Cardinal Protect VDI Fees:
      • CP VDI Base: $34.50/month (Secondary System - Lower CPU and RAM allocation)
      • CP VDI Pro: $55/month (Primary Systems - Higher CPU RAM allocation. - Ideal for Zoom calls )
    • Cardinal Protect for Windows on physical hardware will be available Spring 2022
      • A Cardinal Protect Systems installation requires a full wipe and rebuild to ensure a clean system start. 
      • Cardinal Protect Physical Hardware Fees:
        • Windows and macOS w/ CRC support - free*
          • Attesting "Yes" to: "Are you required to use a Cardinal Protect System to comply with Stanford's Minimum Security Standards ("
        • If you want a Cardinal Protect System not for minsec requirements there is a $99/year CRC Support fees + $17 licensing fee (Licensing Fees to start 2023).

The following teams are still required to use a PAW for managing critical infrastructure

  • [ISO] Information Security Office
  • [UIT] Central Windows Active Directory Team
  • [UIT] Enterprise Technology Teams that provide support for the Central Windows Active Directory Infrastructure
  • [UIT] BigFix Master Operators (Not Department Console Operators)
  • [UIT] Endpoint Engineering Team
  • [UIT] LAN Engineering and Backbone Teams


Ring 0 PAW Users

  • Current Ring 0 PAW users will continue to be supported through CRC
  • Ring 0 PAW support will continue via SNow requests.


Last modified February 28, 2023