4
votes

Most companies I have worked at have had either a collection of disks or a network share with the installs of the commonly used software in them. This is to allow the IT dept and skilled users to install the software they need on their work machines very easily.

However some users would see this as an opportunity to get "free" software for their home machines.

I've seen the draconian approach of locking the machine down completely, but that does not work well (in my view - if you disagree feel free to comment on it) because

  1. You add so much extra work to IT
  2. Users get that big brother feeling

So how do you find a way to prevent users from taking home software but still allowing them to install what they need?

You can make the assumption that most of the users in the organisations I work in are smart enough to install software, I'm not worried about the tea lady here.

4
  • 4
    Why do you care what people take home? You know, there are a lot of places where you can find "free" software easily...
    – Dani
    May 20, 2009 at 8:02
  • 4
    My first job was in a small start-up, I asked my boss if I could install the dev tools we used at home. He gave me a long speech about I.P. rights, Microsoft licencing etc, and said that in his position as director of the company, he couldn't condone what is - what ever way you looked at it - blatant theft. He then looked over that the cabinet where the installation floppies were kept (yes, it's that long ago) and said "Gee, I'll have to get a lock for that . . . some day", laughed and winked. 'nuff said . . .
    – Binary Worrier
    May 20, 2009 at 10:06
  • 5
    The problem is that those "free" licences are using your product key. If an employee takes home a "free" copy and then proceeds to share it with some of his buddies (and so on), your key (possibly an expensive volume licence) is getting pretty public. Companies like Microsoft don't ignore the piracy scene - if they see a volume licence key online, they can figure out which company it belongs to.
    – David
    May 20, 2009 at 12:31
  • @David: that sounds like it could be serious. You should make sure your employees know that should happen. That way, if one of them helps that happen, it will be clear grounds for termination and prosecution.
    – John Saunders
    May 20, 2009 at 16:07

8 Answers 8

Reset to default
20
votes

You can't really fix this with technology. Fix it with standards and policies instead.

Make it clear what your users are allowed to do and not allowed to do with software, and what the consequences are for not complying.

Then trust them. You'll have to anyway (for instance, there are programs to retrieve keys from existing installations so even controlling key distribution isn't going to do it)

10
votes

Why are you letting them install software themselves? Usually there is a system is place to do this, either with servicedesk (level 1 type support) or software like Altiris which installs apps with admin rights even if the user doesn't. Also, your users would need admin rights on the local PC which is also a bad idea.

We have an app share that is locked down by security group of which only a few IT staff are members. Users are not admins and get an error if they try to install anything. Otherwise they would install all sorts of crapware. Even the "skilled" ones. Actually they are usually the worst.

In addition if you let users install whatever they want how do you enforce licensing?

2
  • "Why are you letting them install software themselves?" The OP covers this in his question "In addition if you let users install whatever they want how do you enforce licensing?" You can do this by reporting what is installed (and requiring them to get approval through some process before installing).
    – The Archetypal Paul
    May 20, 2009 at 9:33
  • If they need approval first, and this approval involves someone going through the hoops of ensuring there are enough licences or buying another, then it seems like there is already enough man power to just havethe help desk install it for the user. Frankly this scheme sounds like either the company is either way overpaying for licences, or is pirating software by not buying enough licences. This will hurt a bit when Microsoft does an audit and fines you when they detect x copies of Office on your network, but only y licences.
    – David
    May 20, 2009 at 12:35
6
votes

Lots of good answers about technological fixes here (altiris, centralized installation).

But actually this is about covering your own ass. Make it the employees problem if he gets caught. Because it's probably good for your company that people take software home. What could be better than having the employees learn the software for free? The better they get at using the software you use, the more valuable they are for your company.

3
votes

You can make the msi files available through active directory policy so users can install them if they need them.

They then can't take them home because they don't have physical access to the installation files.

1
  • "users can install them if they need them" and "they don't have physical access to the installation files".... these don't work together very well. ;-)
    – ThatGraemeGuy
    Jun 23, 2009 at 19:03
2
votes

As far as Microsoft software and licensing is concerned, according to the enterprise license agreement your users are allowed one copy of the OS and Office to run at home, so in essence this is already covered.

We have a similiar locked down installation drive that only a select few have access to. I will however admit there is a level of trust among the staff that software will not be taken home, however normal end users are locked down completely from installing any software.

However when dealing with a group of developers, locking them down in this way can be disasterous. Apart from locking it down and only letting the network teams install software, you can't do much about stopping it from happen. You will however find in general there is a very small percentage of individuals that will go as far as taking software home.

The trick is also with who enters the license keys and who keeps them. If you license keys are open to everyone installing software you have already created the situation and there is very little you can do to stop it, apart from requesting new licenses and ensuring their is a process for having them handed out. With us the only way to get the keys is with approval from the IT Manager, and if it is part of your job, an MSDN subscription is purchased in your name.

1
vote

if you don't want to lockdown desktops, then you should take a deeper look at packaging and deploy tools, depends on the OS used in your company, there are either opensource and proprietary tools, ike spacewalk/puppet/cfengine on Linux, for windows you can use ocsng which has the ability to package small software so you can deploy them remotely. this way users can install whatever they want and you have complete control of your company software as users can't access the tool used by your helpdesk to deploy them.

1
vote

Don't let users take DVDs home! At my last employers they used to have an open cupboard where if you could find the install CD you could simply take it and install it.

Unfortunately, you do need a little dose of big brother (but use it in sensible proportions) which should also help you support your users.

  • Audit all your users' PCs to find out what they have installed, and get any software removed that you don't want on the network (or isn't licenced)
  • Maintain an inventory of licences and what's installed and where
  • If a user requires some software, they should make a request to you for it and if you're happy to let them install it themselves let them but require that the media is returned at the end of the day. Once it's installed update your inventory notes
  • If you want to make software available on a network drive limit access according to their need
  • If there is some (free) software that is useful/popular/can be freely installed/does not require an audit trail put this onto a shared drive for users to access
  • Implement a company policy (get senior management to support this) that explains the need to prevent illegal copies of software etc. and point out it can be a dismissable offence

Last year we conducted a security audit at the behest of a client and found we had to think about (and then define a policy and document) issues such as the use of USB sticks and copying sensitive files. You probably don't want to ban USB sticks, but you want to make clear to staff what the company policy is.

It is important to let users know what is expected of them. Then it comes down to trust.

1
vote

The company needs to be proactive about this.

  • Check the license. Some software licenses allow businesses to give employees a copy to run at home.
  • Run license servers. Try to purchase software that requires a running license server at the office - the software won't run without it.
  • Use dongled software. The software is then attached to the dongle. The user can use it at home, work, the pool, and they can't (easily) break the license.
  • Log all installs. Lock down the network drive, have users send a request to have it unlocked for them for a period of time, log accesses so you know which software they installed/copied and keep the records. Make sure they know you do this, and even though you can't tell whether they took it home on a flash drive, the fact that you are watching and there's a process will deter most people.
  • Limit software installs on the network drive to those that have licenses you can protect (license server, dongle, or software that users are allowed to take home, for instance) - software that doesn't meet the requirements has to be installed by IT.
  • Use software on the work PC that can determine what is installed, and log network accesses to the software install drive. Occasionally compare what has been installed with what is accessed - when they've accessed something that was already installed or something that was never installed send an automated email requesting an explanation. Perhaps you'll never act on it, but the fact that you are actively monitoring this will deter most casual users.

In general, if you leave the candy store open and unguarded you will necessarily allow some people to take and use the candy for purposes you don't allow. At the end of the day it's a choice between making things easier or more secure, and the balance is always difficult.

Many companies lock it down except in cases where the user has a valid reason to install software on a regular basis. Except for software developers, IT professionals, and similar employees, the vast majority of computer users never need to install software themselves.

In the case of those that do, they generally can get around whatever you might put in place if they want to.

So, most companies take a hands-off approach.

Keep in mind that if you only enforce it using written policies and procedures, but put in no technical protections, you may be safer than if you put in some technical protections. The employee is always at fault if piracy is found, but if you make a half-hearted effort then it may be argued that you are liable, but didn't do enough. This could be especially damaging if one of your employees decides to torrent your software and licenses.

-Adam

Not the answer you're looking for? Browse other questions tagged .