0

At work, our developers are local administrators on their Windows 10 machine. This is risky since we want to somewhat mitigate risks such as drive-by-download, but we also want productivity and some degree of freedom so we don't want to force them to go through helpdesk for every software update.

We accept the fact that we believe that no internal employee is malicious (this is not to be discussed - just a fact to take into account for this question)

Therefore we asked IT that developers are not local admins anymore, but have a separated account that they can use when they install software. In practice, I think that if they need to install such software, a pop-up comes up, they type the credentials of the other local admin account, the install is done, and that's it, they can then use the program with the unprivileged account.

IT tells us that this is not possible (the privileged account would be Domain Administrator, which is not OK).

Is this true? Is it really not feasible to do this ? It feels obvious to me but I never managed that before (back when I was a dev, I was simply never admin, but here management won't allow that due to productivity issues)

We just want our devs to do their daily tasks on unprivileged accounts but we want to allow them to install custom software for their work (they are aware of risks, know to download from official and trusted sources, they know how to check hashes etc)

This question does not help me entirely; suggestions such as buying extra hardware, doing extra network segregation, or indicating whether it is common or not to be local admin does not answer my question.

  • not perfectly ; an answer with 5 upvotes seems to show that it's possible but I'm not totally convinced (it is not crystal clear) ; Also it's not clear about "local admin" vs "domain admin". What I want to be sure of is that we can setup 2 accounts, 1 unprivileged for work, 1 privileged for installs with only local admin rights (not domain admin) – itittruee Jan 28 at 11:40
  • also answers about the fact that it is common or not do not interest me, and answers about segregating network or having 2 machines is not what I'm looking for. We have a very limited budget and have to deal with what we have.. – itittruee Jan 28 at 11:41
  • What's possible for accounts is more of a Windows question than a security question, and will depend on your situation. It's certainly possible to give people local admin rights without requiring domain admin rights. – schroeder Jan 28 at 11:49
  • There are software packages that allow for users to be local admins, but require a separate password before installing anything. – schroeder Jan 28 at 11:53
0

As a former part time developper I had negociated this arrangement with the IT team.

  • my normal account was a domain member account neither admin of the domain nor of the client machine
  • I had a second account on the machine, not domain member but with a local admin privilege.

And it was enough to allow me to install or upgrade special software without asking the help desk for it.

But the workflow for any administrative task was not as simple as just entering the password of the local admin account (not Unix but Windows...). The bullet proof way was:

  • connect under the local admin account
  • put (temporarily) the first account in the local admin group (=> actually giving local admin privilege to the domain account)
  • go back to the first accoutn and do any administrative task
  • go again under the local admin account to take the main account out of the local admin group (=> actually revoking admin privileges)
  • change again to the normal account and continue normal (non admin) tasks

In theory, it should have been possible to do all the admin tasks from the local admin account, and it was and for correctly written programs. But some beta level tools used to make a mess between the local machine data and the local user data, which ended in them being useable only from the account that installed them.

Nevertheless, I had used that system for years without problem. The IT team trusted me to only use admin privileges when strictly necessary, and I tried hard to never deceive them on that point.

1

IT tells us that this is not possible (the privileged account would be Domain Administrator, which is not OK). Is this true?

No.

Just give them access to a local account that is in the local Administrators group for use when needed. Done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.