Re: Windows Client and Server Security
From: Lanwench [MVP - Exchange] (lanwench_at_heybuddy.donotsendme.unsolicitedmail.atyahoo.com)
Date: 01/23/05
- Next message: John: "Windows 2003 CA in W2K Domain"
- Previous message: Lanwench [MVP - Exchange]: "Re: securing files in a public PC"
- In reply to: Freddy: "Windows Client and Server Security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 23 Jan 2005 12:05:01 -0500
Freddy wrote:
> Hello,
>
> My name is Freddy Bhagalia. I am working as a System Administrator in
> an Organisation. We are into Freight Forwarding business. We have 300
> plus Computers in our Organisation and I am the Administrator of
> these Computers.
>
> I was having a technical discussion with my boss (CIO of the
> Company). The discussion was on "Should we give Administrator rights
> of the local Computer, to the User who is the owner of that Computer.
>
> He thinks that we should give all the Users, Administrator rights.
Why?
>
> I am extremely against this and am arguably not in favour of that.
> According to me if the Admin rights of the Computer is been given to
> the Users, they can put serious problems to their own Computers and
> the Network. Ultimately, the Administrator has to face the music of
> the Users doings.
You're absolutely correct. There are way too many things users can do,
deliberately or inadvertently, if they have admin rights...or perhaps even
power user rights. A virus/trojan or malware/spyware that gets on the PC
will run under whatever rights the logged in user has....the user may try to
change the system clock, remove the computer from the domain, install
software (legal or no) that is not part of your standard build, and your
computers won't be standardized ...and standardization is really important,
especially with 300 computers - although even on small networks it's a good
thing from an admin perspective.
>
> Please let me know your views on the same as I am in a fix, on to go
> about what my boss had asked me for or should I be firm on my
> statement to my boss "Not to give Administrator Rights to the Users".
Turn this question on its head and ask him why he thinks they need it. Users
should have the least amount of privileges required to do their work -
that's just common sense.
If you have badly-written software that requires local admin rights, you can
use FileMon and RegMon from www.sysinternals.com to modify the registry &
file system so it will run under a limited user account.
>
> Regards
>
> Freddy.Bhagalia
>
> Jan 22
>
> email add: freddy@writercorporation.com
- Next message: John: "Windows 2003 CA in W2K Domain"
- Previous message: Lanwench [MVP - Exchange]: "Re: securing files in a public PC"
- In reply to: Freddy: "Windows Client and Server Security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
