Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
2 Rephrased title
| link

Local Security implications of "local admin on host computerOS" vs local"local admin on virtual guest OS"

source | link

Local admin on host computer vs local admin on virtual guest

At work we have a discussion on computer security.

The scenario:

  • Our work PCs are Windows desktops that are part of a windows domain
  • Users have domain accounts they use to log in to windows
  • The user's domain accounts do NOT have local admin access
  • Our organization has a group of developers
  • The developers would very much like to have local admin access to their computers (our experience is that developing on Windows with Visual Studio without local admin is a hassle)
  • But the IT department does not want to give any users any sort of local admin access to the computers (not even create local users)
  • Instead, the developers are allowed to install virtualbox and install whatever they want in virtual machines.

The issue/question:

  • I argue that the security implications of having guest VMs running with local admin, is on roughly the same level as running the host OS with local admin.
  • My reasoning is that if for instance a guest OS was infected by a virus, the potential implications would be on par with the host OS being infected.
  • After all, the guest OS can access the same network resources (on the IP level) that the host OS can (possibly dependent on the VM software config), and therefore the surrounding network infrastructure is exposed to the virus no matter if the virus is running on the host OS or the guest OS.

Am I right? Am I wrong? Does any one have pointers to good articles/discussions on the subject?