My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting.
Helpdesk staff commonly require administrative rights to provide support for end users. I know that this is commonly done (see   ) by creating a
"Workstation Admins" group, and adding that group to the local
Administrators group on each PC. Ideally, the helpdesk staff will use a low-privilege account for daily tasks, and only use their
"Workstation Admins" account when needed.
System Administrators commonly do the same thing, and use an account with higher privileges when accessing servers. This makes sense because servers are trusted machines that are protected both physically and electronically. Therefore, logging in to a server with a privileged account is basically safe.
However, staff at the helpdesk will be logging into machines that were probably constantly left unattended and used for daily email or web browsing. These computers can't be trusted the same way servers can. It's easy to imagine a staff member at the helpdesk logging in to a computer which contains a malware payload that immediately spreads across the network because it has admin rights on many other computers.
Or worse, a malicious user could perform a real-life phishing scam by having a keylogger on their computer, then having somebody from the helpdesk log in.
Is there any way to give helpdesk staff the access they need without creating a significant risk? (I can imagine an ideal solution would use a one-time password for authentication, and the logged-in the user would only be authorized as a local administrator. In other words, I want the helpdesk staff to have access to ANY computer, not EVERY computer.)