0

In the light of fewer technicians to visit sites and install software on to PC's, users are requesting Local Admin rights to do it themselves.

Is there a safe way or procedure of doing this for users in a controlled manner?

  • 2
    Get help desk to remtoe desktop in/remote installation (MSI only)/third-party system management software that does software installation? – billc.cn Aug 19 '16 at 10:57
1

Short story: it is possible and can be used safely for advanced users, but you must know that those user do have administrative rights on their machine from that point.

Now for the longer story:

Giving a local admin account to a user makes sense if he/she is aware of general security rules. Because once he has got it, the admin can no longer protect the machine from his errors. But I used that method as a non admin but professional manager for a laptop. I needed to be able to do administrative operations even in week-end when I could not be helped by my network administators, for example changing an IP address to connect my professional laptop on my personal internet access. Or to install a particular reader to display an important document.

The rule was:

  • I informed the administrators of what I had done with the admin account
  • my normal account had no admin privileges
  • I only used the local admin account for short operations after thinking twice on what the risk was
  • I was often having coffee with the system admins to be fully aware of all the security rules

If you fear that a user could install anything, giving him/her a local admin account is very near to opening Pandora's box: anything can happen beyond that point

TL/DR: while it can save time for both the admins and users, a local admin account should only be given to security educated people

As you were said in comment, if the need for administrative operations is only during normal working hours, and if the ratio user/admin is not too high, remote desktop from the admins can be a safer and simpler alternative...

1

It sounds like you are looking for a Privilege Management solution. There are a variety of vendors that provide products in this space. I would not want to recommend one over any other. You would have to evaluate which is the best fit for your environment and needs. But a good place to start would be looking at what SANS has published for "Controlled Use of Administrative Privileges" at https://www.sans.org/critical-security-controls/vendor-solutions/control/5

0

Local admin accounts for standard users are a bad idea. It opens a slew of other problems to troubleshoot including conflicting software, unintentional changing of necessary settings, etc. You're providing a larger surface to attack if you allow your users to be local admins to a box and creating more issues for updating / managing 3rd party software.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.