Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In a corporate environment, should developers have admin rights on their computer? Why?

Technological environment:

  • Windows 7
  • Visual Studio 2008 & 2010
  • SQL Server
share|improve this question

closed as not constructive by Jason Berg, Zoredache, Zypher Feb 8 '11 at 17:58

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
3  
Also see: stackoverflow.com/questions/701214/… –  Zoredache Feb 8 '11 at 0:45
2  
3  
I'm voting to reopen this one because despite the somewhat subjective nature of the question this is one almost every Windows admin (I can't comment on other platforms) WILL face during his/her career. The answers posted so far provide information that I believe will help others when faced with this issue. –  John Gardeniers Feb 8 '11 at 21:44
2  
If I could vote to reopen this, I would. –  jmort253 Mar 13 '11 at 1:41

23 Answers 23

Should they? That's up to the corporation. Personally I think it's fine as long as there are some understood rules.

  1. Being admin on your box is a privilege NOT a right.
    1. Catching viruses on multiple occasions will get the right revoked
    2. Disabling corporate agents will get the right revoked - AV/inventory/software deployment/etc
    3. Basically if you do something that risks the network will get the right revoked
  2. Any tools you install must not be made a dependency of your project without getting them on the officially approved list. Ask nicely don't come crashing in the day of the deploy and demand $random_library be installed on all servers with no testing
  3. For anything outside of normal applications installed everywhere else support will be best effort. Help desk and/or sysadmins will not spend 5 hours trying to debug why you have dll conflicts.
share|improve this answer
18  
Good list. Would add also that if the product will ultimately be run by users w/o admin rights then you need to test accordingly (real usability testing). Too many developers do the poor man testing where they test on their dev machine on which they have god rights. The product works well and they give it a stamp of approval only to learn that it chokes in a non-priv'd environment. –  Shawn Anderson Feb 8 '11 at 0:36
4  
@Shawn, there is a reason you need testers as well as developers. –  Ian Ringrose Feb 8 '11 at 9:20
7  
This is a typical network admin reply who doesn't understand why do developers require admin privileges. This should be decided by a manager level person who has managed or been a developer in the past. Otherwise you'll keep the machines free of virus and office free of developers. –  Hasan Khan Feb 8 '11 at 12:12
11  
@Hasan and this is a typical developer reply who has never had to deal with an infested network saturating a DS3 with traffic taking down the entire office. I'm not asking you to do anything all that onerous here. –  Zypher Feb 8 '11 at 13:00
6  
In a development house you're in business because of the software the development team is churning out. I've worked in several businesses where the machines were locked down to a degree that made the job impossible and we had a hard time convincing people we needed admin privileges to run the development tools. Or where internet access was cut so that we couldn't even read the online documentation. Or an antivirus product that scanned every database record insert and so therefore hurt performance so much that it was impossible for us developers to make the software run properly. –  Matt Feb 8 '11 at 14:45

Typically I would say yes. Things like debuggers require pretty high if not admin rights to work correctly. Developers often need to install random software which can take days or weeks to get installed when going through channels. During that time the developer is usually work stopped costing the company nothing but money, especially if the developer is a consultant.

share|improve this answer
10  
+1 - developers are (usually) fairly intelligent people and keep their machines clean –  Mark Henderson Feb 7 '11 at 23:26
9  
Don't say that. :) –  mrdenny Feb 7 '11 at 23:28
4  
@Mark, I have yet to see evidence to support that claim. –  John Gardeniers Feb 7 '11 at 23:32
4  
@Mark Henderson, you may be fortunate enough to actually be working with a good group of people. One if the sites I read daily gives me the impression that not all developers are created equal. –  Zoredache Feb 8 '11 at 0:31
8  
I believe there's an old Klingon proverb that goes, "Beware programmers carrying screwdrivers." –  Bart Silverstrim Feb 8 '11 at 1:59

In a Windows environment, and especially when using Microsoft developer products, the dev will require admin rights on their machine. If you deny them those rights their ability to do their jobs will be restricted, if not prevented altogether.

share|improve this answer
1  
Maybe. But they should be required to test their code in a non-privileged environment if they are making a product for user consumption. –  Bart Silverstrim Feb 8 '11 at 2:00
2  
@Bart, I fully agree but the devs should be doing their testing on a separate machine anyway because the dev tools create a completely different environment to that of a "normal" computer. –  John Gardeniers Feb 8 '11 at 3:27
    
@BartSilverstrim that doesn't always follow. Just because the user part of the application runs as a normal user doesn't mean all components do (eg. consider a service-client, the server is likely to need higher privilege). And then consider the installer... –  Richard Feb 8 '11 at 8:19
1  
@Richard, that's also true but I believe Bart's point was that the testing needs to be done in an environment that is as close as possible to what the customer will be using. –  John Gardeniers Feb 8 '11 at 21:39
1  
The correct answer to a software issue not related to system tasks should almost never be "run as administrator." –  Bart Silverstrim Feb 9 '11 at 2:24

There is both science and art in development; it isn't as simple as "knowing" what we need. If we already had the answer half our job would be moot; finding the correct approach is often iterative, and may involve multiple tools in unpredictable ways. Requiring an intermediary to install each of these (often with high latency), only to find (about an hour in) that for your scenario the "super-uber tool addon" is needed is silly.

While a VM is ideal for this, there are also a lot of development tools that cannot run (properly, or even at all) in a VM, because they themselves are a VM - and I don't mean things like JVM; I mean full machine emus/vms, such as device toolkits. Compatibility there is improving.

Additionally, most development tools have a very large footprint - much larger than "regular" tools (making VM hosting a bit more painful than you might expect), and often by the nature of being a process debugger require elevated access. Not to mention the fact that they may be GUI intensive; trying to run full-time on a VM GUI is... extremely painful.

Performance is a huge are here; would you think it was OK for users to wait 3 seconds after every keypress in Word for their key to register? I am not kidding - development tools on VMs etc can be this sucky; for most development purposes you need responsiveness. Interrupting the flow of complex logic from brain to keyboard can make it pretty much impossible to get the job done. And I hate to say it, but yes: development time is expensive.

share|improve this answer
2  
+1 - well said :) –  Michael Shimmins Feb 8 '11 at 12:15

In being a developer, I rank us a level of privilege above the basic user, but below the systems administrator(s).

I may, on occasion, need an extra library installed to get the application I am developing to work in the production environment, that being said, I have a strict rule I develop by: "For any application which requires third-party libraries, the libraries should be installed in a sandbox environment prior to production deployment and, in some cases, prior to application development."

The sysadmin I work with and I agree to this, and between the two of us, we will actively enforce that rule and delay any application deployment that has not passed the "dependency checks".

To answer your question though, yes, developers should be given full access to their own machines, but those machines should be isolated from the environment the application will ultimately be deployed on. In which case, even the application deployment should be sandboxed until deemed safe to deploy in the production environment.

share|improve this answer

Disclaimer: I'm a developer.

To me, this question (and the answers) seem to be attacking the problem from the wrong approach - that is, the debate is focusing on what admins want/need vs. what developers want/need. But you specified we are in a corporate environment, so let's look at it that way.

So let's imagine we are arguing this in front of the director of IT or operations, or whomever controls our budget, and ask these questions.

  1. What is the minimum privilege required to perform department functions? This is our baseline.
  2. What are the risks of granting them more access? (actual risks, not just best/worse case scenarios)
  3. What is the true expected cost of granting them more access? (support costs, fixing inadvertent changes made by inexperienced admin, etc)
  4. What is the true expected cost of not granting them more access? (lost productivity, requiring IT support to perform daily tasks, turnover of experienced people due to morale, etc.)

With these questions answered, you can make an informed decision rather than a passionate one.

For your specific environment, there are some things that require admin rights (see User Rights and Visual Studio) - if they are not doing those things, then you can answer questions 2 - 4.

As a consultant, I have seen both extremes of this policy, and while I always want to have admin access to a machine, in some cases it didn't make sense. And I'm not sure what is cause and what is effect, but without exception, every place that I've seen doing windows development where the devs had admin access also had MUCH higher productivity from every developer than places where they were locked down.

share|improve this answer
    
+1 because you put it in the right perspective. Take out the personal preferences of devs and admins and focus on what is important to organization as a whole. –  Jaap Coomans yesterday

I think you are asking the wrong question, you should be asking:

Will a good developer work for an employer that does not give him/her admin rights on their PC?

What someone “needs” and what they expect are often not the same thing, after all you don’t need to allow a developer to drink coffee in works hours, but if you don’t…

(Make sure you make your policy clear at interview stage, otherwise you may get people taking the job that then despise your company due to the lack of admin rights – don’t expect programmers to think in a logical way about this sort of thing!)

share|improve this answer
    
I'll admit that I both work in higher education and am a "systems administrator/programmer", as is everyone in my group, so I guess my experience isn't totally relevant. But I can't imagine working as a developer at a shop that wouldn't give me full control over my workstation (OS choice and installation, software choice, etc.) let alone root privs on it. –  Jason Antman Feb 8 '11 at 14:55

It depends actually more on who you ask then about who actually needs it. If you ask corporate IT and risk management groups they will be all over you with horror stories (and if they are to give it to you they demand a goat sacrificed in a holy bond of promise that they will not be held responsible), the developers on the other hand demands admin rights mostly because the job is stressful and demanding enough without having to seek permission from help desk to go take a leak. The sad state of affairs is that now its more about power struggle and exerting power then it is about business and productivity needs (e.g. it boils down to who will make the other jump through hoops)

IMHO, the best work environment I've seen to this day is where the two groups are being kept separated. Developers have their own domain in the forest (whereby IT controls what this domain and its users can do in the rest of the company) and they are all local admins with experienced guys with MCSE acting as local domain admins, they have their own test environment and can do pretty much what they want and need on their local LAN with a single IT policy (no pirated software). Corporate IT is not responsible and does not render support to devs and only enforces some high level corporate rules (no facebook, porn or similar through firewall, devs not allow to mess with corporate LAN) and they all have RSA based VPNs to work from home which puts them directly inside their LAN. Neat, isn't it?

share|improve this answer

The answer is likely to be subjective and specific to each individual scenario, but in most cases I would say yes.

share|improve this answer

I would say that administrative rights are important for the development process. Given the relative ease of using a VM to sandbox though, there's no reason why you can't put them in a VM and keep security.

Anything goes wrong and you can wipe and rebuild in a matter of minutes.

share|improve this answer
2  
There's one very good reason not to lock them into a VM - performance. A dev working on a major application could easily use every bit of a high spec machine with massive amounts of RAM, fast HDD, etc. Putting them on a VM is about the same as giving them back their machines from a few years ago. Great for security but not so good for productivity. –  John Gardeniers Feb 8 '11 at 1:51
1  
But great for forcing developers to write to the low end of officially supported machines in the project. Moreover, with virtual servers we're able to do fault tolerance (and in some cases main load) support for live products. All a matter of what machine/cluster your VM is run in. –  DivinusVox Feb 8 '11 at 5:24
4  
It isn't about writing for the low end of requirements, its about using tools that require higher performance than VMs allow. Using Visual Studio 2010 inside a VM is noticeably less responsive than on bare metal. The product you're writing may run just fine in a VM, but that doesn't mean developer's tools always do. –  Michael Shimmins Feb 8 '11 at 6:24

Definitely! Usually a lot of the development that goes on may or may not be in a virtual environment. Admin rights help to overcome a lot of the overrides of service handling, registry entries, and IIS locally. On the other hand, it depends on how much trust you have in your developers.

As a developer, it's frustrating when something doesn't work because we don't have access.

share|improve this answer

Depends. As a developer, one should always operate on the principle of least privileges. If you are working as a government contractor, you might be contractually obligated not to have admin access, for example.

As a Java developer, I've hardly had a need to have admin rights on my machine on an ongoing basis. However, there are legitimate cases when you need on-demand admin access (.ie. you need to move your laptop across physically separate domains, and you need to change your NIC accordingly.) That was the only time were I've really needed permanent, ongoing admin access to my machine.

Sometimes you need admin access because IT is understaffed (or incompetent or mired in red tape.) But if you work with a competent IT department, they can install the stuff for you even remotely (or by providing custom installers that will "run-as" admin and install the stuff for you by just clicking in them.)

So the answer (again) is - it depends. Do you have a responsive IT staff that can install things on demand (or within a reasonable time)? Do developers actually need it for the tasks they are paid for?

If the developers truly and legitimately need it (as in "I will literally WON'T be able to do anything without it") as opposed to a convenience (as in "I want to install whatever I want"), and if IT support is not sufficiently responsive (for whatever reasons), then yeah, they should have admin access to their machines.

Otherwise, no. Remember the principle of least privilege, people.

share|improve this answer

There are developers and there are Developers. If a "developer" is some $40/hour JBoss java guy writing rules for a rules engine then of course not. If a "developer" is a $350/hour C/Assembly guy getting your video editing software to run as fast as possible on a GPU, then yes, of course.

share|improve this answer

For corporations that are worried about security, they will have security persons dictate and attempt to enforce a policy that works with their model of development and systems. In a Windows Environment most people will tell you that you must have Administrative rights on the host they are developing on in order to perform their tasks.

This is not necessarily true...

You can create a custom policy and have all programs and functions work with development users on a system. You will just have to get down and dirty and into the nitty gritty with custom permissions on program/system directories with groups or custom groups depending on the desired design.

Most corporations will say it is very dangerous for developers to have systems on open networks because hackers could gain control and start compiling their own tools so going through the task is much worth the risk in my professional opinion.

share|improve this answer
    
While what you say is technically correct it is also a nightmare to implement and maintain and creates fragile environments. –  John Gardeniers Feb 8 '11 at 0:05
    
I would rather then full access on the dev network, and then only connect to the corporate network over the internet with a VPN if this is a real issue. I also a lot of corporate it departments I have seen provided me with less then what a good ISP does!! There is no need as a developer to be on the same unfiltered network as the account department etc. –  Ian Ringrose Feb 8 '11 at 9:17

Developers should (ideally) have two domain logins.

One that has local admin rights (for development work) and one that has the same rights as everyone else in the company. Then, they can test their work on a representative set of permissions.

This should then reduce the likelihood of ItWorksOnMyMachine-itis that appears occasionally.....

share|improve this answer

On Windows it is very important that UAC is turned right up on developer machines. This will force the developers to be aware of UAC in their development.

I suspect that an awful lot of development houses don't do this and suffer from problems when their apps go to testing and/or customers.

share|improve this answer
    
I couldn't disagree more. The UAC should be enabled on the TEST machines but is nothing more than an irritant and productivity killer on the machines used for coding. The problems you're referring to only happen when there is no proper test environment. –  John Gardeniers Feb 9 '11 at 2:45
    
@john if it's killing your productivity when coding you are doing it wrong. I never see uac dialog whilst coding. What are you doing wrong? –  David Heffernan Feb 9 '11 at 7:35
    
@john the idea that developers write code and testers test leads to poor code. Particularly in small dev houses. –  David Heffernan Feb 9 '11 at 7:37
    
I said nothing of separate coders and testers but you're completely wrong about that producing poor code. The worst person to test code is the one who wrote it. In time you will learn these things. –  John Gardeniers Feb 9 '11 at 10:38
    
@John It's a myth that the worst person to test code is the one who wrote it. Often it is only through writing a piece of code do you fully understand how to test it. A separate tester brings something else to the testing exercise but it is follow to abandon the knowledge that the implementor has. There is also no need to patronise me. –  David Heffernan Feb 9 '11 at 10:48

If the box has all the software on that you need to do your job, then there's no need to be an admin. Having your account part of the debugger users group is all you need.

In my experience though in the one place where I wasn't an admin it took 3 days to get my machine installed with everything I needed; and then the IT guy gave up and gave me admin rights and the discs so I could install everything myself.

If a company has a policy of no devs as admins, then they need a good IT department to keep the devs productive.

share|improve this answer

Something should be taken in account: If the software that is given to developers is to restrictive/hard to get. In extreme situations this may have as consequence a complete reinstall of the OS by the developer - what probably represents a much bigger security risk for the company than mere admin rights.

share|improve this answer

I'm a programmer, I don't run my windows VMs as admin because I do most of my testing on them as well as coding. Most of my colleagues run everything as admin. When I need to install something I do it from the command line with runas (in XP) or as local admin.

I'm not saying to make 'em domain admins.

That being said, please treat developers like the royalty that we are. We need to be able to run things as administrator and run things as regular users and with other user rights if need be. If the rights are abused, feel free to depose us - but not restrict us, that's not why we went to school.

share|improve this answer
1  
That being said, please treat developers like the royalty that we are - Please tell me you're being sarcastic!?!?! –  Andrew Taylor Feb 8 '11 at 14:08
    
Not sarcasm, just exaggeration. Programmers are the kings and queens of the realm of computation and I defy anyone to say otherwise. –  Peter Turner Feb 8 '11 at 15:03
1  
the business (the people who write the payroll checks) get to say who the kings and queens are. It varies from company to company. –  mfinni Feb 8 '11 at 15:24
    
if Programmers are kings and queens Admins are deities made flesh. –  Jim B Feb 16 '11 at 2:00

It depends on the development tools being used. For web-based development I would say that it's not really necessary. For application development a resounding yes.

Think about it. Lets say I need to develop a piece of software that runs as a service. How am I to even install that service?

What about the installer? I need to be able to write and test the installer which means I need the ability to install software locally.

And what about debugging? the debuggers in tools like developer studio require admin rights to run properly.

Without that ability we application developers can't actually carry out the job.

Now with that being said. It still is possible to restrict some things. For example, I worked for a company that gave me admin rights, but I wasn't able to disable the anti-virus software. Not even temporarily, although this was a problem as it hurt application performance really badly!

It is also possible to lock down other things. But my advice is, leave it rather open for developers. They generally need it that way.

share|improve this answer

Definitely maybe.

If they really need those rights they should have an admin account they use only to do installations and when they really need it, and an account with a normal level of access which they use most of the time.

Sure, they will log in with the admin account most of the time, but you got to give them the same lecture about responsible behaviour that all sysadmins had or should have had before getting root passwords, sudo rights etc...

share|improve this answer

On my current corporate PC build, I need it. I sign away my rights to support and must conform to assorted policies of course

On my future PC (Windows 7), I shouldn't need it: everything has been packaged correctly for me. And I mean everything. Someone asked developers what they want for a change.

In summary, local admin is a sign of incorrect tools or permissions for the job in hand.

Developers should also not have local SQL Server installs but that's a different issue...

share|improve this answer

I have to (apparantly) provide the dissenting voice and say not only no but "heck no". I have no problem giving devs admin rights on a sandboxed VM that has no network access. Zypher had it almost right (correction bolded):

"1.Being admin on my box is a privilege NOT a right." These systems are corporate assets that I am ultimately responsible for. When Joe Developer installs his pirated copy of Microsoft Bob ("because I needed it") it's not going to be him that has to explain how it wasn't found before the audit. Developers routinely think that somehow the corporate rules just don't apply to them. By giving them a sandboxed VM they can follow all of the rules everyone else has to follow (since now only IT can copy files to and from the system). Magically the request system gets used by developers again, the sky is no longer falling when Joe Developer mangles his development box - he just asks for a new one (or a restore if he's asked for backups)

Mr. Denny mentioned developers costing money when they have to wait for apps to be installed, A. hello ... my time is usually just as valuable as Joe Developer (usually more so since I keep the exisiting crapware running- and do I really have to mention all the time spent helping Joe developer debug his last masterpiece), and B. when dev goes overbudget because they were waiting for an application and try to blame IT for it I'd say:

Your lack of planning for what you need to write software is not my responsibility, we have a standard set of tools and if that toolbox is missing what you need you should have had your requests to get more tools expedited rather than attempt to make me jump thru hoops to get it for you because your deadline is tomorrow.

Having said all this, locking down the desktops of developers stinks, if you could weed out the crappy developers that think thye are entitled to watch their baywatch collection and are outraged to learn they can't install babewatch player to view them ("but it's open source") you might be able to loosen up. But for every great developer out their that "gets" it, there's 10 more that your company is going to hire for that 200 million dollar vertical application instead, and that's who you need to watch out for.

EDIT: It's certianly quite possible that the developers I've been exposed to are unusually dull (polling the current crop only 1 has heard of stackoverflow, to give some level of benchmark). The starting point of view that I begin with is "what do you need to do what the company is paying for you to do". If you need admin rights you get them, but you shouldn't stqart with them and if I can give you a box that frankly I don't care what you do to it and that works then we are both good to go.

share|improve this answer
14  
Wow, the BOFH lives amongst us! You have failed on the basic principle that our job is primarily one of enabling everyone else to do their jobs as best we can within the limits imposed on us by policies, legal requirements, etc. It is NOT one of arbitrarily dictating to others how they are to work simply because it suits us to do so. –  John Gardeniers Feb 8 '11 at 4:48
    
+1 for the last paragraph. You can eliminate all the other paragraphs if you just hire decent developers. –  Robert Harvey Feb 8 '11 at 5:57
6  
Wow - love the us and them mentality. Did you consider that "his" deadline is actually "your" deadline too since you're all in it together (presumably) for the benefit of the company. I don't know you from a bar of soap, but you remind me of the nasty, arrogant, try-to-find-a-way-to-say-no-rather-than-yes typical sys admin. For everyone 1 good sys admin out there there are another 10 that your company hires that perpetuate the stereotype you just laid out and make every else in the company's lives that much harder. You should be concerned with service delivery, not constraint. –  Michael Shimmins Feb 8 '11 at 6:20
    
I have specifically addressed most of these points in an answer: serverfault.com/questions/232416/… –  Marc Gravell Feb 8 '11 at 8:54
1  
Maybe YOU are the reason that the “the developers you been exposed to are unusually dull”…. A company has to decide if it wants freethinking or dull developers and can’t act in a way that freethinking developers hate and then expect to keep anyone apart from dull developers. However dull developers can be best of a lot of corporate work. –  Ian Ringrose Nov 19 '13 at 9:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.