Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My notebook users need to travel a lot.

Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings.

Should I give them local administrator's password for solving shuch problems?

share|improve this question

migrated from superuser.com Mar 1 '12 at 23:04

This question came from our site for computer enthusiasts and power users.

1  
Thats up to you, its your risk to to let them possibly mess something up - we can't decide that for you. –  Simon Sheehan Mar 1 '12 at 20:16
2  
By what you have asked, no one can guess the relation you and the users have. So more explanation of the situation would be helpful, otherwise this question will likely be closed, its just too vague. –  Baarn Mar 1 '12 at 20:18
2  
As Walter said, the appropriate answer is completely up to you and your users. There are ways to allow people to install most printers without given them full admin. But you need to, based on your company policy and technology environment, make this decision yourself. –  music2myear Mar 1 '12 at 20:25
2  
Why not just give them permission to install printers? –  Kyle Mar 1 '12 at 20:26

3 Answers 3

up vote 4 down vote accepted

The answer is: It depends.

It depends upon your relationship with your users, and how much they can be trusted to not create problems, and the extent to which you want to support laptops where the user has administrator-level access, and the necessity of administrator-level access from a mission/business perspective.

It's just a question with a bunch of tradeoffs, and you'll have to decide from the perspective of your own organization what makes best sense for you. The benefit of giving your users admin-level access is, as you identified, it may allow them to solve problems themselves, e.g., while on the road or while your support help desk is not open, or without contacting your support help desk. The disadvantage is that it users now have the power to shoot themselves in the foot. They can make changes to settings that render their system unreliable or unusable; they can install software that is malicious, bad, or just contrary to your organization's policy. You may see those users later at your help desk asking you for help getting their laptop working, because they screwed it up (they may not even realize it is their own darn fault). On the gripping hand, if you lock down users' laptops too tightly, and you have power users, they may come to resent the IT department for controlling things with such a tight fist, which is not good for your organization.

I would ask yourself what kind of relationship you want to have with your users, what level of support you want to provide, and what risks you want to accept or not accept.

For the most part, this has only a modest connection to security. There are some increased security risks from giving users admin-level access on their own machines. However, from a security perspective, even if users don't have admin-level access, they can still get infected by software that steals all their files, so it's not like withholding the administrator password somehow automatically eliminates all security risks.

share|improve this answer

There would seem to be circular logic in this question.

From the point of view of security, the whole point of passwords is to protect some asset. In the case of Windows 7 the idea behind having different levels of access for administrate and user accounts is to protect the operating system from corruption, malware, viruses etc. Having administrative passwords really does nothing to protect user data files like a word document since the user account has to have access to those files for the user to edit them.

If you are looking to protect the operating system files, as opposed to corporate secrets, then admin passwords work reasonably well.

Now you introduce the factor of user convenience. The user wants to use a new printer on short notice and does not want the inconvenience of having to check with IT and having to wait for them to perform some function.

Which leads to the user wanting to plug in some unknown USB device that has never been vetted by IT and letting that device self-identify and cause the downloading and installation of drivers.

Since it is an unknown device in an uncontrolled environment it could clearly cause the installation of malware such as a keystroke logger etc. Further even if the device is legitimate, there is no guarantee that the network being used at that time has not been hacked. For example when the OS goes to download the driver from what the user thinks is the HP website, it could easily, and without the user's knowledge, be going to an alternate website (bogus DNS entries etc.) which downloads a driver which appears to work but which also includes malware.

So where is the security?

share|improve this answer

I am assuming they are using windows:

You could set a local policy on the machine that allows the user to "Load and unload device drivers"

If you open gpedit.msc go to computer configuration > windows settings > Security settings > local policies > user Rights Assignment > Load and unload Device drivers

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.