My notebook users need to travel a lot.
Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings.
Should I give them local administrator's password for solving shuch problems?
migrated from superuser.com Mar 1 '12 at 23:04
This question came from our site for computer enthusiasts and power users.
The answer is: It depends.
It depends upon your relationship with your users, and how much they can be trusted to not create problems, and the extent to which you want to support laptops where the user has administrator-level access, and the necessity of administrator-level access from a mission/business perspective.
It's just a question with a bunch of tradeoffs, and you'll have to decide from the perspective of your own organization what makes best sense for you. The benefit of giving your users admin-level access is, as you identified, it may allow them to solve problems themselves, e.g., while on the road or while your support help desk is not open, or without contacting your support help desk. The disadvantage is that it users now have the power to shoot themselves in the foot. They can make changes to settings that render their system unreliable or unusable; they can install software that is malicious, bad, or just contrary to your organization's policy. You may see those users later at your help desk asking you for help getting their laptop working, because they screwed it up (they may not even realize it is their own darn fault). On the gripping hand, if you lock down users' laptops too tightly, and you have power users, they may come to resent the IT department for controlling things with such a tight fist, which is not good for your organization.
I would ask yourself what kind of relationship you want to have with your users, what level of support you want to provide, and what risks you want to accept or not accept.
For the most part, this has only a modest connection to security. There are some increased security risks from giving users admin-level access on their own machines. However, from a security perspective, even if users don't have admin-level access, they can still get infected by software that steals all their files, so it's not like withholding the administrator password somehow automatically eliminates all security risks.
There would seem to be circular logic in this question.
From the point of view of security, the whole point of passwords is to protect some asset. In the case of Windows 7 the idea behind having different levels of access for administrate and user accounts is to protect the operating system from corruption, malware, viruses etc. Having administrative passwords really does nothing to protect user data files like a word document since the user account has to have access to those files for the user to edit them.
If you are looking to protect the operating system files, as opposed to corporate secrets, then admin passwords work reasonably well.
Now you introduce the factor of user convenience. The user wants to use a new printer on short notice and does not want the inconvenience of having to check with IT and having to wait for them to perform some function.
Which leads to the user wanting to plug in some unknown USB device that has never been vetted by IT and letting that device self-identify and cause the downloading and installation of drivers.
Since it is an unknown device in an uncontrolled environment it could clearly cause the installation of malware such as a keystroke logger etc. Further even if the device is legitimate, there is no guarantee that the network being used at that time has not been hacked. For example when the OS goes to download the driver from what the user thinks is the HP website, it could easily, and without the user's knowledge, be going to an alternate website (bogus DNS entries etc.) which downloads a driver which appears to work but which also includes malware.
So where is the security?
I am assuming they are using windows:
You could set a local policy on the machine that allows the user to "Load and unload device drivers"
If you open gpedit.msc go to computer configuration > windows settings > Security settings > local policies > user Rights Assignment > Load and unload Device drivers