(no subject)

[red-scully.livejournal.com]

I've just moved companies from an IT department that locked its machines right down, to one where users have full admin rights over their machines (both laptops and desktops).  In the week I've been in this new place, I've seen maybe 5 machines infected with viruses, and several that needed reimaging because their owners have installed so much junk on them that they move at a snail's pace.  In my last job, where I was for nearly 4 years, I think I saw one virus infection, and it got caught and cleaned by the server before the user even logged in.

I'm still quite new in the IT world, so answer me this:  should users be granted admin rights over their machines?  Am I wrong in thinking that this is a completely stupid and utterly reckless plan that leads to nothing good at all?  Does anyone have any good examples of when users having admin rights is actually beneficial to the IT dept?

Comments

[jecook]

Never. Ever. EVER. Should local admin be handed out willy-nilly.

At my place, users are only granted local admin if the apps they use absolutely, positively DEMAND IT.

[altorogue.livejournal.com]

In my opinion, HELL NO! I worked in a small college IT department, and you would not BELIEVE the shit I had to clean off staff and professor's computers. In my time there, we gradually got a lot better control over everything, and it was SO much easier. If it's something they don't want you to know about on the machine, they shouldn't have it on a work machine in the first place.

*shudders from thinking about it*

[jjjiii]

It only makes sense for users to have admin rights if:

1. They need them.


2. They are knowledgable enough to use them without getting into trouble.


3. The organization has well-defined rules for what you can do or not do with a computer, and for the stuff to do, how to do it.

Usually, by the time you have the third criteria, you're able to figure out ways to give ordinary users exactly what they need, and nothing more, without giving them full admin privileges.

Most organizations that I've seen stumble badly at at the second criteria, and have a hard time determining when the first criteria is truly applicable. A huge step forward in my opinion would be achieved by insisting that users be computer literate. And mandate required training whenever someone says "I'm not computer literate, ha ha." Making computer literacy a requirement for basic employment in any position where using a computer is a normal part of the work would help tremendously.

[tallanvor.livejournal.com]

A lot of it depends on the company. In all the companies I've worked for, all users have had local admin rights. Then again, these have all been software companies, and telling developers they can't have local admin access is, shall we say, not a smart idea.

And even Microsoft gives all users local admin rights.

[mouser.livejournal.com]

Should? No - there's no reason for it.

Will they? Yes, because the IT director (or whatever) either doesn't know his job or has been ordered to by politics - normally by those that don't know better.

[torkell]

It's always surprised me when I see a place that hands out full admin rights, but in some cases it makes sense (e.g. software development - I believe you can allow debugging with restricted accounts, but local admin is a lot easier and more useful).

[vortex.livejournal.com]

Absolutely!
Especially in a development environment when developers have to install and uninstall software all of the time.

I think locking down systems leads to stunting creativity in the work environment, stunts employee morale and ultimately detracts from business profitability and flexibility. The idea of locking everything down is paranoid, arcane and ineffectual...

[nem0.livejournal.com]

I'm on the cusp of revoking everyone's local admin rights. When I started, the company consisted of about 15 people in one building, most of them running Win2K, most of them relatively savvy, and they were supported by a part-time geologist-hydrologist, part-time IT god. Three years later, we've got over 50 users in 3 offices (and any number of remote locations at any give time), and some of these people are bloody morons.

My predecessor's justification was that he didn't have time to support everyone, and our line of business involves a whole lot of piddly little apps that need to be installed at random -- no point in locking things down so every time someone decided they needed a copy of HEC-RAS, they'd have to call IT, especially when IT is probably in East Bumblefuck for the week doing well monitoring. That and up until recently we didn't use the same spec machines, so building a universal image was right out.

But by the end of the year, I'm phasing in user rights lockdowns and keeping up with audits of installed programs, because I'm tired of these fucking cowboys bringing me a laptop with 15 toolbars in IE, three fake anti-virus programs, and some awful viral infection that requires a nuke-from-orbit/reload Windows to dislodge.

SHORT VERSION: don't give them local admin rights. They're probably not responsible enough to use them.

[manuka.livejournal.com]

The only times we've ever had a problem with malware on a desktop was when the user had been granted local admin privs they had no business having.

The only times we hand out local admin privs are to the IT staff, and to some powerusers that have demonstrated that they both need the admin privs (due to a few lousy applications that don't play nice w/o local admin) and can be trusted not to FUBAR the system. And they get the local admin privs with the understanding that if they *do* FUBAR it, we reserve the right to mock them mercilessly.

[siliconshaman.livejournal.com]

In my experience, you can make handing out local admin rights works IF...

1] the user base is knowledgeable enough not to fuck it up completely...
2] the user base is too terrified of you to fuck it up completely...

Ideally, one educates the ignorant so they don't screw it up again.

Requiring them to do forfeits before you fix their machine works pretty well as motivational tool.

[thecrazyfinn.livejournal.com]

Depends seriously on the userbase.

My (support) department had local admin for years. In fact at one point my personal system was a box that IT had NO login for at all (RedHat machine) and that lasted a couple of years until software requirements forced me back onto Windows. But you had to be seriously knowledgable to even be in said support department, a large part of our country-wide in-house software were written by people in my department.

We've just been switched over to our overlords continent-wide AD network and all lost Local Admin. It sucks. But I can't see a company as large as our new overlords allowing department-wide Local Admin on systems not intended specifically for developers.

[simoncion.livejournal.com]

*'nthing the "Give developers admin privs, everyone else is a no-go." sentiment*

[snyperwolf.livejournal.com]

... telling developers they can't have local admin access is, shall we say, not a smart idea.

Indeed. Speaking from the other side, I've had to send code out untested because I don't have proper rights on the dev servers. I spent a week trying to test the code in any way I could, but in the end, I had a deadline and the sysadmin team wasn't going to stoup down to handle my request (despite even my boss requesting it as well).

[curmudgn]

Not so, B; as two-three other people have observed here, there are apps used in corporate environments (and I use some of 'em daily) that simply refuse to play nice if you ain't got local admin to yer own box.

[agentdanak.livejournal.com]

while i generally agree with locking down the admin rights, i must admit i am a little annoyed at not even being able to defrag the machine i use at work, which we've determined is at least 8 years old.

the last time it came down and let it be defrag'd, i ran the damned thing about 10 times.

two months later, the thing is running slow as sludge again. i think it's just time for a new machine, really.

[jamoche]

telling developers they can't have local admin access is, shall we say, not a smart idea.

Software engineer, here. Worked for a place that had rules like that - I couldn't have the admin password for the Solaris box that was right under my desk. And you had to have an admin password to shut down the machine. So I could pull the plug but I couldn't shut down. Yeah, *that's* smart.

And at that, I was one of the lucky ones to *have* a Solaris box under my desk, because they were convinced that a team of Unix/Linux engineers could do all their work on PCs using whatever POS emulation software I've blanked from my memory. I had to have a real Solaris because I worked on the graphics code, and half the time we had a bug reported in the graphics, you couldn't reproduce it with the emulator - the other half it was *caused* by the emulator. (Hmm, it's trying to display BGR when we're telling it RGB? Yes, that *will* make the colors look funny. No, that's *not* my fault.)

Just a voice on the other side

[merlin-t-wizard.livejournal.com]

The Co. I work for once tried to restrict admin access to our machines. It would probably work for about 95% of their workforce, but for the 5% that I'm a part of, it was a disaster. I'm only connected to the corp LAN once every few months. And, as our software is equipment revision specific, I need to uninstall/reinstall with every customer. Just a thought. Of course, I'm not the typical (l)user either...

[mouser.livejournal.com]

I know of several that require admin rights to a specific directory or two, but that's an easy fix.

I do know ONE that requires admin for registry stuff but that was a one time thing.

[vortex.livejournal.com]

Another thing to consider is how many of your users are on Laptops.

A large user base on laptops will almost certainly require local admin rights, particularly when they are on the road and need to install software updates and such...

[jokergirl.livejournal.com]

Very much. In my small engineering consulting company (everyone was at least a MSc in a relevant subject) we had such a lot of different configurations and programs to manage it saved a lot of time to have engineers install the programs they needed at the moment themselves.
I've done some troubleshooting as IT admin, but it mostly involved getting rid of itunes' update checker which was slowing down all network traffic and telling people that they really shouldn't install that kind of crap on their work computers. I've even had people reinstall their computers from scratch with me only being there to enter the admin password for joining the domain. Relaxing!

;)

[jokergirl.livejournal.com]

I should of course say that this is far from your typical user type, but if you're working with consultants, you should expect that they will NEED this freedom.

;)

[xforge.livejournal.com]

I imagined it was universal but it's nice to see our sysadmins aren't the only ones who are surly, uncommunicative and, strictly from the POV of the frontline technicians, a bunch of inept assclowns. Okay, that last part might just be our bunch.

[ghostdandp.livejournal.com]

Agreed.

Unfortunatly at my place of work half the software needs it, so it's standard just to let em have admin rights. Probably causes 50% of our problems. I've talked to them abotu white listing and they say it'll be too difficult.

Re: Just a voice on the other side

[trixtah.livejournal.com]

So, you give local admin or power user rights to that 5%, not 100%. And you tell that 5% that if anything goes wrong, the first step is to reimage it to the standard configuration.

[jimbojones.livejournal.com]

I go back and forth on this one. In the late 90s, I had everybody on NT4 workstations and only Power User rights, and that kept them garbage-free. In the early-to-mid 2000s, though, the whole fucking game changed, because all of a sudden half the malware on the web was capable of using privilege escalation exploits to dig itself in. So at that point, locked-down users were MORE of a pain in the ass, because they still got themselves malwared AND they couldn't do a lot of relatively simple shit without me coming to wave the Admin Wand over their workstation.

I'll also note that supporting engineers is a lot like supporting software developers - if you don't let people running AutoDesk software have local admin rights, you had better be prepared to spend A FUCKING LOT of time walking by workstations waving The Magic Admin Wand.

So in conclusion, I'd say it's sort of like oxygen levels in the atmosphere over geologic eras. That shit fluctuates from one era to another, it's not constant.

[green-ogre.livejournal.com]

To me, it depends.

Generally anyone developing windows applications needs local admin rights.

Then you have the people who need to install or update their job specific software all the time and most of the software is dumb and required local admin rights to run. In my last job, we only had 2-3 people who hit this requirement, so it added work to maintain them but not too badly.

I was incredibly lucky in my last job and was able to set the rules. And I am bastard, I locked down local admin, all corporate wide software was pushed through GPO and patches/antivirus were also pushed out.

I loved that setup, 2/3 of the company only used windows for Office and email, so we almost had no problems. And most virus infections could only infect their profile. The other 1/3 were developers and they would occasionally mess up their machines, but they were generally good people and if you pointed out that they brought this on themselves usually they didn't repeat the problem.

Now at my new company, everyone has local admin rights.... the two saving graces are (1) by policy if I spend 10-20 minutes on it, I can wipe and reimage the machine (and the reimage setup works wonderfully) and (2) I am primarily a UNIX admin so it's not my problem.

[At my last job I was the UNIX admin but due to layoffs I ended up essentially the senior guy for everything with a junior PC helper]

[tecknow.livejournal.com]

Oh good, it isn't just me. It seems like most engineering apps are stuck in the 90's, or if you're really unlucky the 80's when it comes to anything having to do with UI or the OS they're hosted on. The more specialized the use, the more likely it is to assume you're still using windows 3.11

[tecknow.livejournal.com]

In an ideal world, most users wouldn't need local admin rights, but in addition to archaic software that simply refuses to work without it, even if you use only conventional software, IT has to be really on the ball to pull that off.

At the university where I work, most people can do most things on most machines, why? Because there's no policy on what software should be used, it's all up to individual professors/projects and while they try, it simply isn't possible for IT to stay ahead of the random stuff people need.

[hisamishness.livejournal.com]

It's all in the context.

Locking down the fingerpaint in an Art class doesn't make much sense, and Not locking down the fingerpaint when the room is used for Math or Shop classes is just dumb.

[vortex.livejournal.com]

I understand your reply, but I think you used a "not similar" example.

Your example would work better for an environment such as a library where multiple people use the same machine.

I think the OP implied, and I responded to the context of, and environment where you have one user per desktop/laptop and that user having full local admin rights.

Today's computers are not Terminals, like we used to manage in the early days of Mainframe/client environments (where locking everything down started). Employees are pretty much required to multi-task and be flexible and I submit that their equipment should do the same...

Re: Just a voice on the other side

[merlin-t-wizard.livejournal.com]

Unfortunately that would lead to the techs having admin capabilities and the managers wouldn't. And it just wouldn't do for the techs to have capabilities that the managers don't have. /sarcasm

[pne.livejournal.com]

n+1.

Recently, there was a bit of a kerfuffle at my orkplace where all employees who started before "x" date were asked to sign an agreement (newer ones supposedly signed it as part of their employment contract).

Part of the kerfuffle was over the fact that the agreement contained three unrelated things (software installation on computers; secrecy/confidentiality; knowledge of the official software development process), but a major part was over the first of those things.

See, it said that we were not allowed to use software unless it had been installed by IT.

In a software development company.

It was pointed out that this might make sense for the administrative area, where they typically only have a half-dozen apps they use (such as Office and SAP), but does not for the developers -- depending on the definition of "software" and "install" it would mean I couldn't even install, say, Hibernate for use with Java, or even "install" the software I'm developing onto my own machine in order to test it!

It turned out that what management *really* wanted was to prevent (a) unlicensed commercial software and (b) non-work software (such as World of Warcraft).

At any rate, I think pretty much everyone refused to sign the agreement and a new one is being worked out now.

[anthalus.livejournal.com]

Give them all the rights in the world, as long as they are running on an emulated copy.

[mariasama16.livejournal.com]

Old response, but when said flexible employee learns that the work computer is MY computer and not theirs and thus, to leave the non-work stuff off of it, at that point, they can have full admin rights. Until they learn those basic facts, no, users do not get full admin rights.

It also depends on the environment of the company. I had one I worked for that was a manufacturing company, and all the computers were locked down because the majority of the employees had no computer literacy whatsoever (see 10 minutes to find the start menu). Another company I worked for was also a manufacturing one, but had a large number of designers/white collar employees. They gave everyone full admin rights and we had many issues with things as a result (of course, inadequate virus protection on top of that just kinda compounded problems).

[vortex.livejournal.com]

Isn't one of our main purposes, as IT people, to find/diagnose and fix these problems?

I say, it seems a lot of people here are intent on "fixing" themselves out of a job...