Re-evaluating Local Administrative User Rights
-
@scottalanmiller said in Re-evaluating Local Administrative User Rights:
@Pete-S said in Re-evaluating Local Administrative User Rights:
So the only thing they should be able to screw up is their own computer - in which case you should be able to bring it back quickly with automation.
In theory, but even in a zero trust, simple rebuild you need a process for them determining that they need to be rebuilt, a rebuild, an update.
you can make the system ephemeral, but it almost always causes a productivity loss.
agreed - sure, it's only their computer screwed up, but isn't that bad enough? Removing admin removes a lot, granted not ALL, but a lot of the risks, enough that not giving them admin, or at minimum, not running as local admin is worth it in my mind.
-
@Obsolesce said in Re-evaluating Local Administrative User Rights:
What about cases where a computer is used for dev work on which the users are using mob programming practices and running docker containers?
What are some ideas in that space?
Use AWS / Azure dev environment for them.
-
@scottalanmiller said in Re-evaluating Local Administrative User Rights:
@Pete-S said in Re-evaluating Local Administrative User Rights:
That said, I think developers need their own server(s). A test environment where they can create and destroy VMs and run containers and whatever else they need. Do development and run performance tests. Let them run wild in there. It could be cloud or on-prem or whetever it is they are developing.
Devs don't need to be admins to do that. I have devs, they can do this... without admin rights. Could they be admins in dev? Sure, not a big deal. But no reason for them to waste time doing that, either.
Well, they need to be admin on their VMs they create for sure. If they need to be admins on their own workstation depends on what tools they need to run there. If they are working like they are on thin clients and use their dev environment for everything, then they need nothing local.
-
@Dashrender said in Re-evaluating Local Administrative User Rights:
@scottalanmiller said in Re-evaluating Local Administrative User Rights:
@Pete-S said in Re-evaluating Local Administrative User Rights:
So the only thing they should be able to screw up is their own computer - in which case you should be able to bring it back quickly with automation.
In theory, but even in a zero trust, simple rebuild you need a process for them determining that they need to be rebuilt, a rebuild, an update.
you can make the system ephemeral, but it almost always causes a productivity loss.
agreed - sure, it's only their computer screwed up, but isn't that bad enough? Removing admin removes a lot, granted not ALL, but a lot of the risks, enough that not giving them admin, or at minimum, not running as local admin is worth it in my mind.
Depends on how they work and what they are developing.
Unfortunately it is far too common that IT serves itself and not the need of the users. Question is if you are trying to make your own job easier at the expense of making their jobs harder, or if you are trying to come up with something that is better for everyone?
-
@Pete-S said in Re-evaluating Local Administrative User Rights:
@Dashrender said in Re-evaluating Local Administrative User Rights:
@scottalanmiller said in Re-evaluating Local Administrative User Rights:
@Pete-S said in Re-evaluating Local Administrative User Rights:
So the only thing they should be able to screw up is their own computer - in which case you should be able to bring it back quickly with automation.
In theory, but even in a zero trust, simple rebuild you need a process for them determining that they need to be rebuilt, a rebuild, an update.
you can make the system ephemeral, but it almost always causes a productivity loss.
agreed - sure, it's only their computer screwed up, but isn't that bad enough? Removing admin removes a lot, granted not ALL, but a lot of the risks, enough that not giving them admin, or at minimum, not running as local admin is worth it in my mind.
Depends on how they work and what they are developing.
Unfortunately it is far too common that IT serves itself and not the need of the users. Question is if you are trying to make your own job easier at the expense of making their jobs harder, or if you are trying to come up with something that is better for everyone?
Many will say that tools that require local admin on their own machine are likely horribly tools to begin with. Why would a dev need local admin to write code? - the written code should be running in a test environment that I could be convinced that for expediency the devs have local admin rights over...
-
@Pete-S said in Re-evaluating Local Administrative User Rights:
Well, they need to be admin on their VMs they create for sure.
They don't, actually. If they were spinning them up completely from scratch... actually even then they wouldn't. It's really not something that devs need unless there isn't IT. If you don't have IT, then you might need it for anyone, even a janitor.
-
@Pete-S said in Re-evaluating Local Administrative User Rights:
If they need to be admins on their own workstation depends on what tools they need to run there. If they are working like they are on thin clients and use their dev environment for everything, then they need nothing local.
As someone who owns a dev company, I can assure you devs don't need this stuff. And rarely is it helpful. Devs often demand this, but I can't think of why they'd need it. Devs designing code environments is actually a pretty major, and common, mistake. If the devs are local admins to their dev boxes... how do you know that they are setting up the dev environment in a way that will be reflected in a proper production environment?
Letting devs do this would actually explain some of the common massive blunders we see in software design where software is built with the expectation of not being deployed in a production manner (for example... by requiring ridiculous dependencies, not considering licensing, or requiring that the software be run as admin.)
-
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
-
@jmoore said in Re-evaluating Local Administrative User Rights:
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
This is exactly what IT and those users should be doing...
It's what I do - I have a user account just like everyone else at my company and a domain admin account for my admin stuff.
I know that since I can easily do much of my work without local admin - no user in my company needs admin (our uses are pretty low - we are a medical company, not a technical one).
-
@jmoore said in Re-evaluating Local Administrative User Rights:
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
Perhaps. But actually logging into an admin account means they they would be logged in and have admin rights full time while logged on, and that works around the whole thing.
As a compromise, I think sticking to exceptions being able to temporarily obtain local admin rights, with warning, acceptance message, etc. That will force consciousness of the fact.
-
@Dashrender said in Re-evaluating Local Administrative User Rights:
@jmoore said in Re-evaluating Local Administrative User Rights:
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
This is exactly what IT and those users should be doing...
It's what I do - I have a user account just like everyone else at my company and a domain admin account for my admin stuff.
I know that since I can easily do much of my work without local admin - no user in my company needs admin (our uses are pretty low - we are a medical company, not a technical one).
Domain admin is a totally separate discussion and nothing to do with this.
-
@Obsolesce said in Re-evaluating Local Administrative User Rights:
@Dashrender said in Re-evaluating Local Administrative User Rights:
@jmoore said in Re-evaluating Local Administrative User Rights:
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
This is exactly what IT and those users should be doing...
It's what I do - I have a user account just like everyone else at my company and a domain admin account for my admin stuff.
I know that since I can easily do much of my work without local admin - no user in my company needs admin (our uses are pretty low - we are a medical company, not a technical one).
Domain admin is a totally separate discussion and nothing to do with this.
Well - in my case, I only have two accounts - domain admin (i.e. the admin account) and my domain user (non-admin) account. So I use domain admin/local admin interchangably... but I get your point.
-
@Obsolesce said in Re-evaluating Local Administrative User Rights:
@jmoore said in Re-evaluating Local Administrative User Rights:
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
Perhaps. But actually logging into an admin account means they they would be logged in and have admin rights full time while logged on, and that works around the whole thing.
As a compromise, I think sticking to exceptions being able to temporarily obtain local admin rights, with warning, acceptance message, etc. That will force consciousness of the fact.
Are you using a product that allows for this temporary gaining of local admin rights?
-
@Dashrender said in Re-evaluating Local Administrative User Rights:
@Obsolesce said in Re-evaluating Local Administrative User Rights:
@jmoore said in Re-evaluating Local Administrative User Rights:
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
Perhaps. But actually logging into an admin account means they they would be logged in and have admin rights full time while logged on, and that works around the whole thing.
As a compromise, I think sticking to exceptions being able to temporarily obtain local admin rights, with warning, acceptance message, etc. That will force consciousness of the fact.
Are you using a product that allows for this temporary gaining of local admin rights?
Yes you could say that.
-
@Obsolesce said in Re-evaluating Local Administrative User Rights:
@jmoore said in Re-evaluating Local Administrative User Rights:
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
Perhaps. But actually logging into an admin account means they they would be logged in and have admin rights full time while logged on, and that works around the whole thing.
As a compromise, I think sticking to exceptions being able to temporarily obtain local admin rights, with warning, acceptance message, etc. That will force consciousness of the fact.
Yes true. I wasn't very clear, a fault of mine. What I do is run under a plain user account and when something that required admin credentials i just enter in those credentials. I was not meaning for the user to just log in as the admin account. Of course you have to trust they will do this, so thats not full proof. Its just what I do.
-
@jmoore said in Re-evaluating Local Administrative User Rights:
However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
That's fine if they are authorized. That's how IT should be doing it themselves, IMHO. This is how you properly give that kind of access.
-
@Obsolesce said in Re-evaluating Local Administrative User Rights:
@Dashrender said in Re-evaluating Local Administrative User Rights:
@Obsolesce said in Re-evaluating Local Administrative User Rights:
@jmoore said in Re-evaluating Local Administrative User Rights:
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
Perhaps. But actually logging into an admin account means they they would be logged in and have admin rights full time while logged on, and that works around the whole thing.
As a compromise, I think sticking to exceptions being able to temporarily obtain local admin rights, with warning, acceptance message, etc. That will force consciousness of the fact.
Are you using a product that allows for this temporary gaining of local admin rights?
Yes you could say that.
Why so coy?
-
@scottalanmiller said in Re-evaluating Local Administrative User Rights:
@jmoore said in Re-evaluating Local Administrative User Rights:
However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
That's fine if they are authorized. That's how IT should be doing it themselves, IMHO. This is how you properly give that kind of access.
Yes but this topic is more about preventing a blanket local admin rights enablement, identifying risks, pros, cons, and options to compromise. Not really at all about IT's ability to gain local admin rights. Ideally nobody at all will have local admin rights ability. If something is wrong and needs fixed requiring local admin, it can be done via MDM means, ideally.
We don't want any one person or account local admin access across the board or across multiple devices either.
Intune makes any of these possible, and some are currently in practice, but that's starting to steer off the path a little.
-
@Dashrender said in Re-evaluating Local Administrative User Rights:
@Obsolesce said in Re-evaluating Local Administrative User Rights:
@Dashrender said in Re-evaluating Local Administrative User Rights:
@Obsolesce said in Re-evaluating Local Administrative User Rights:
@jmoore said in Re-evaluating Local Administrative User Rights:
I would agree in most situations no user needs to be admin on their own box. I think this is the way to go about things. Of course there are a lot of other factors as others have mentioned. However, if someone at your company tells you to compromise, what about having a seperate admin account that they only use when necessary? Then the rest of the time they use their regular account.
Perhaps. But actually logging into an admin account means they they would be logged in and have admin rights full time while logged on, and that works around the whole thing.
As a compromise, I think sticking to exceptions being able to temporarily obtain local admin rights, with warning, acceptance message, etc. That will force consciousness of the fact.
Are you using a product that allows for this temporary gaining of local admin rights?
Yes you could say that.
Why so coy?
Not intentionally, just wanting to stay on the main discussion.
