Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Beyondtrust.com published a report, somewhat recently, claiming among other quite compelling things, "90% of Critical Microsoft Windows 7 Vulnerabilities are Mitigated by Eliminating Admin Rights"

Other interesting 'facts' they provide say that these are also mitigated by NOT running as a local admin:

  • 100% of Microsoft Office vulnerabilities reported in 2009
  • 94% of Internet Explorer and 100% of IE 8 vulnerabilities reported in 2009

BUT, reading the first page or so of the report I saw this line:

A vulnerability is considered mitigated by removing administrator rights if the following sentence is located in the Security Bulletin’s Mitigating Factors section, ―Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

could be sounds pretty weak to me so and I wondered how valid all this really is. I'm NOT trying to say it's not safer to run without admin rights, I think that is well known. I just wonder if these stats are something you would use as ammo in an argument, or use to sell a change like that (removing users as local admins) to business side? Thoughts?

Link to the report (pdf)

[should this supposed to be a community wiki?]

share|improve this question
    
+1 for raising this interesting question, and for pointing out that we shouldn't take reports like this for granted. –  Jed Daniels Apr 7 '10 at 19:56

3 Answers 3

up vote 0 down vote accepted

Yes and no, if you're facing a targeted attack, Even by Microsoft's own admission, Locally Exploitable Privilege escalation flaws are comically easy to find and are published on a semi-regular basis. Furthermore. BEPs (Browser Exploitation Packs, like mPack, Silence, Eleonore) are incorporating things like the #GPtrap handler exploit into their packs as administrators become more savvy.

Denying user's admin access is good, but is far, far, far, from a complete solution.

share|improve this answer

Yes of course it will protect your system (windows, office etc.). Because regular users don't have editing rights on windows and program files folders (where target files for viruses and exploits stored in). All that viruses and exploits can do in this case - infect user's profile, which can simply be fixed under Administrator's account by just deleting User's profile or with simple virus scanner.

share|improve this answer
3  
+1 with the caveat that it isn't bullet proof. Some exploits can elevate privileges and still hose your system. I'm assuming that is the other 10% in the report. –  MattB Apr 7 '10 at 14:14

Without admin rights you don't have access to:

  • Program Files
  • Windows Directory
  • The main registry
  • Other users profiles
  • Auto runs (only your own logon)
  • Create services

So it is very hard to compromise Windows without access to the above.

As @Dimitry says as a limited users all you can screw up is your own profile... In theory...

I suggest you have a look at http://serverfault.com/questions/128587/is-it-normal-to-give-users-administrator-access-to-their-company-pc for a similar discussion.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.