Solved

Change from Local Admins to Local Users Group

Posted on 2014-10-09
11
191 Views
Last Modified: 2014-10-09
I look after a number of networks for small businesses and most if not all have their Users as local administrators (all are in a domain environment).
From a security and operational perspective my preference is to have Users not be local admins, but I am curious to if there are any best practices or guides on transitioning and any gotchas I should test first.
0
Comment
Question by:Flipp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 4
11 Comments
 
LVL 96

Expert Comment

by:Experienced Member
ID: 40372078
Having a regular (normal) user as a local admin is a sure road to problems. All of my clients have accepted this thinking and problem level is very low.
0
 
LVL 6

Author Comment

by:Flipp
ID: 40372089
I suppose a two fold issue in that there is the technical side which I want to get some info on as well as test, but to sell to the business manager .... any advice?
0
 
LVL 96

Assisted Solution

by:Experienced Member
Experienced Member earned 500 total points
ID: 40372095
As I noted, clients have asked me and we have tested local admin users. It always results in problems (people do silly things with computers). As a result, we have backed away and at this point ALL users in ALL clients are regular users. None are admins. It is cheaper for me and my colleague to service requests regularly than to fix broken operating systems. Managers and owners find we are more economical than careless or unthinking users.
0
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 96

Expert Comment

by:Experienced Member
ID: 40372098
technical side which I want to get some info on as well as test, <--- I am not sure what technical information. There are as many ways to break computers as there are users.
0
 
LVL 6

Author Comment

by:Flipp
ID: 40372108
Things like configuring UAC or other components that will affect a User that goes from being an admin to a standard user. I know keeping Adobe Flash and Java up to date could be a headache if we restrict our users from these upgrades due to software requirements to always having latest version and regularity of upgrades being released.
0
 
LVL 96

Accepted Solution

by:
Experienced Member earned 500 total points
ID: 40372110
Users should never be allowed to configure UAC. It almost never needs to be turned off.

Adobe and Flash are problem children. We just schedule those updates.  People will try to download Flash (it can't be) and get malware in the process.

Windows updates are automatic on shutdown.

After a decade at this, I have heard ALL the reasons and then some. I am cheaper than a user who does not know what they are doing.
0
 
LVL 6

Author Comment

by:Flipp
ID: 40372115
Do you deploy/manage updates for Reader, Flash and Java Runtime? I am pretty happy with simply using GPO to deploy these but also know the application itself can update itself.
0
 
LVL 96

Expert Comment

by:Experienced Member
ID: 40372119
Our clients are small businesses so we just update as needed. Adobe updates 2 or 3 times a year. We see clients weekly. Similarly with Flash and Java. It is easy to manage.  We have a number of laptops not on domain (mostly not in the office).

Windows updates are the most frequent and they are automatic.
0
 
LVL 96

Expert Comment

by:Experienced Member
ID: 40372122
my preference is to have Users not be local admins,  <-- I certainly agree and I think I have given you lots of reason to proceed with your own preference. It is not perfect but it is better than the alternative.
0
 
LVL 6

Author Closing Comment

by:Flipp
ID: 40372124
Thanks John - a great summary. I do like the basic setup of managing the core software updates across platforms with Users as non-admins.
0
 
LVL 96

Expert Comment

by:Experienced Member
ID: 40372125
@Flipp - You are most welcome and I was very happy to help. Good luck with your clients and users.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We asked our MSP customer base what their favorite tools were and how they help them serve clients. We focused our questions on favorite tools in the following categories: >PSA tools >RMM tools >Alert management tools >Communication tools and Mo…
Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
This Micro Tutorial will teach you how to the overview of Microsoft Security Essentials. This is a free anti-virus software that guards your PC against viruses, spyware, worms, and other malicious software. This will be demonstrated using Windows…
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.
Suggested Courses

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question