We always have at least one contractor on site and because they are involved in different products / technologies, different software needs to be installed on their PC's. This takes up a lot of support time and is basically a never-ending stream. Giving them admin rights would allow them to do this work themselves. The downside is that they now have rights to do anything. How have other people handled this?
We have a somewhat-controlled environment; while we may grant power-user access (which is usually enough to get'er done) we don't grant local admin; in fact, local admin is considered a "safety valve" feature in case we need to get administrative access to the machine and it can't (for whatever reason) get domain authentication.
Local admin on most machines isn't too big a deal, but you do not want to give out Domain Admin rights, which opens up a whole Pandora's box of issues.
Many of the "local admin" issues we've seen have come from poorly-designed software that, despite nearly a decade of changes on the Desktop, still think they are running in Windws 98 & Friends. The software installers are insisting that you give these rights because:
- the install package was poorly designed
- the installer contains nasty chunks of code that need to be registered at a system level (think ActiveX)
- the program's code base is very old and as such it suffers from both (1) and (2).
If possible, try to convince the contractors to bring all their software at once and have an "install fest", so you can go through this one time and get it over with. If they are dragging this-that-and-the-other all the time into these systems, even with Admin rights, it's going to be a bit of a mess - are these going to be production systems in the future? Is the sequence of installation and the dependencies needed written down somewhere? There are some dangling loose ends that need to be tied up by letting them do what they want.
So, yeah, if you don't have a problem with security issues, trust issues, compatibility issues, and you're documenting things as needed, go ahead and let them do the local admin installs, using a password that is distinct from all of the other ones.