Re: Granting all users Admin Rights
From: Jeremy Marten (jer5@shaw.ca)
Date: 05/21/02
- Next message: x y: "Re: Ipsec Overhead on W2K network"
- Previous message: ktemplin: "AD Admins Denied Log On Locally"
- In reply to: Russ Levanway: "Re: Granting all users Admin Rights"
- Next in thread: Stephen Souza: "Re: Granting all users Admin Rights"
- Reply: Stephen Souza: "Re: Granting all users Admin Rights"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Jeremy Marten" <jer5@shaw.ca> Date: Tue, 21 May 2002 19:32:15 GMT
Giving users in an environment that big Admin rights is asking for trouble.
In an educational environment there would be alot of people who could
seriously screw up your machines very easily.. installing their favorite
video game written for windows 98 on a nice new 2K workstation.. trying to
update some drivers and blue screening your pc. God help you if you get
some first semester Comp Sci kid trying to setup a secret Linux dual boot.
Even worse any closet hacker wanabee would install Lophtcrack and pull up
other users (possibly domain admins) who have logged on before them. Why
open yourself up to any of it?
Setup a group that will allow "elevated" users (faculty or lab monitors) to
be able to install programs. This will still allow for users to install
what they need quickly, they just ask a lab assistant or prof to help them
out. Make sure to educate these point people know what they are being asked
to install though..
Jeremy
"Russ Levanway" <rlevanwa@cuesta.org> wrote in message
news:#mzej8OACHA.2228@tkmsftngp02...
> Greetings,
>
> I am a Network Admin for Cuesta College and we are dealing with the same
> issue. To cut right to the chase, the vast majority of users have no need
> to be local administrators. On the other hand, there are a number of
> serious installation related issues with leaving all users as local users
> because of Office 2000 apps install processes, and the neccessity of our
PC
> Techs to go to install every little piece of software on users computers.
> Consequently, I believe that giving users Power Users rights is the best
way
> to go. Users can install many apps, but they cannot install an app that
> runs as a service, for example.
> Maybe restricting users to local users is the most secure way and best way
> for your to keep track of licensed software and only allow installation of
> authorized software. However, unless you use SMS or LanDesk for software
> distribution, you will have a potentially big management headache to deal
> with.
>
> Regards,
> Russ
>
> "Robert A Klopotoski Jr" <eaglek96@hotmail.com> wrote in message
> news:1989821b.0205161238.6b5993ef@posting.google.com...
> > Hello All,
> >
> > I am currently the network manager at a small college with about 250
> > faculty and staff compuers(1500 students). I am in the middle of
> > implementing a windows 2000 domain. The network is currently peer to
> > peer workgroups with win95, 98 and 2000 clients. In the process of
> > building the domain, I am also trying to get every client onto windows
> > 2000 so I can take advantage of the many features it allows in
> > conjunction with active directory. The most important thing to me
> > since I am starting from scratch is setting up rules and guidelines
> > for the users of the network. My background before working here was
> > working at a high-tech engineering company.
> >
> > Recently I have hit a snag with the management here where we cannot
> > agree on whether or not users should be allowed local administrative
> > rights on their machines. In my last company I was forced to give
> > admin rights to most users so they could develop and install hardware
> > on their local machine. I don't really see the need for the rights
> > here, but the people making the executive decisions disagree with me.
> > I am curious to know how other colleges or academic institutions deal
> > with this issue. It is my opinion that people should not need admin
> > rights as a function of their job and any software installations
> > should be routed through IT. The people making the decisions feel
> > that restricting rights would infringe upon adademic freedom.
> >
> > I see several problems with granting a regular user admin rights. The
> > main reason is that system files become accessible and could be
> > corrupted very easily by accidental clicks, viruses, etc... I also
> > want to be able to control the licensing of software, and want to keep
> > the shareware to a minimum. Not having admin rights greatly reduces
> > their ability of screwing things up on the machine. It also increases
> > the security of each machine by knowing that many services can't be
> > inadvertantly disabled or uninstalled.
> >
> > The users that I am referring to are all Faculty and Staff. Each
> > person has a machine in their office to use. We are not an
> > engineering school or anything like that, and only have a few teachers
> > who teach computer related fields.
> >
> > If some people could give their feelings on this it would be greatly
> > appreciated. I apologize if some of you feel this isnt the right
> > newsgroup, but to me this seems like a security issue. Mainly my
> > question is asking how other groups handle this? Should we give in
> > and grant rights to everyone, or is it important to stand firm on my
> > own opinion.
> >
> > Thanks in advance
> > Rob
>
>
- Next message: x y: "Re: Ipsec Overhead on W2K network"
- Previous message: ktemplin: "AD Admins Denied Log On Locally"
- In reply to: Russ Levanway: "Re: Granting all users Admin Rights"
- Next in thread: Stephen Souza: "Re: Granting all users Admin Rights"
- Reply: Stephen Souza: "Re: Granting all users Admin Rights"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
