• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 174
  • Last Modified:

all users being in the local admins group

Hi all,

Just looking to get some opinions on normal users being local admins on their pc's. we have a development center with 500 people and most of them are local admins because they need to install software etc.. what do you think is good practice for something like this? everyone powerusers?

many thanks


3 Solutions
Rob StoneCommented:
If its possible it would be better to have everyone as Power Users, although some apps require admin rights to install.  You could use an GPO to publish software to specific users? That way you will know whats being installed and when without them being admin users.

If you want to change the admin groups on all the PC's you can use NetDom.exe.
I don't like to give admin rights to the users, because you never know what they gonna  install. I know not everyone will abuse those rights, but there are too many people who abuse that right.
tdvitAuthor Commented:
i hear you jvuz but what can you do if you have to facilitate users.  if power users doesnt do it, whats the alternative.  We as IT people have to bite the bullet and just give it to them.  from everything that I am reading there doesnt seem to be a workable alternative.
Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Rob StoneCommented:
What about creating a install account thats in the local admins and then tell them to use the RunAs option to install apps that need admin rights.

You can also audit logon's for a week or so to see who is logging on to their PC's with that user and you can then tell them not to do so.

That or get a procedure where you remote control their PC and put in the user name/password yourself when they need to install the software, but they would need to inform you when they need software installing.

In the long run, its better to have managed systems by the IT dept so you know whats being installed, then if things go wrong you have a better idea of fixing it.
Gareth GudgerCommented:
I assign local admin rights usually. To me only have local administrator rights doesnt pose any threat in my eyes. A lot of it depends on the environment of course. A development company I would do it where I know the computer liiteracy would be high enough to avoid any stupidty (deleted a key folder etc) but would restrict admin right from those who do not need it (accountants, admin staff etc). Other environments I would block it completely and leave it at just regular users (like in a Realtor company with public use computers)

If the users hafe admin rights, they can install everything, also software where you need a license for. If its freeware, I don't think it's a problem.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Train for your Pen Testing Engineer Certification

Enroll today in this bundle of courses to gain experience in the logistics of pen testing, Linux fundamentals, vulnerability assessments, detecting live systems, and more! This series, valued at $3,000, is free for Premium members, Team Accounts, and Qualified Experts.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now