Solved

Limit Local Admin Rights

Posted on 2014-11-04
5
285 Views
Last Modified: 2014-11-07
Most of my windows users have the local admin access in order to properly run two major/custom applications.
This means they can also download/install other programs (including viruses) and make changes to many things.

I want to know if it is possible to limit admin access using windows or some other application?

Thanks, your help is much appreciated.
0
Comment
Question by:cP6uH
5 Comments
 
LVL 90

Accepted Solution

by:
John Hurst earned 500 total points
ID: 40421830
Administrators have the keys to the kingdom and uninformed administrators wreck computers.

RULE 1. No user is administrator .
RULE 2. ALL users have UAC turned on.

Not much else you can do with Windows.

You can implement Power Broker for Windows from Beyond Trust. That provides the granular approach you want, but is an add-on product to Windows and your server.

http://www.beyondtrust.com/PowerBroker-Desktops-Windows-Edition.aspx?section=PowerBroker-Desktops-Windows-Edition
0
 
LVL 9

Expert Comment

by:dlb6597
ID: 40422170
I've been able to get many apps working by using process monitor from sysinternals/microsoft. It records all file and registry access and lets you filter on access denied. I launch process monitor, setup filters on the specific app and look for access denied in the log...then grant the appropriate permissions to those registry keys and or file locations to allow the applications to run without local admin privileges. It takes some time, but it is worth it in the end.
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40422705
If security matters to you, avoid software that requires admin accounts.
John's advice, powerbroker desktop, is capable of doing what you require, empowering standard users to use selected applications with higher privileges securely - windows alone is not.
0
 

Author Closing Comment

by:cP6uH
ID: 40429064
I will adjust the UAC settings on each workstation, and get a quote for Power Broker from Beyond Trust.
Thank you.
0
 
LVL 90

Expert Comment

by:John Hurst
ID: 40429069
@cP6uH  - Thanks for the update and you are very welcome.
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Healthcare organizations in the United States must adhere to the guidance of both the HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health Act) for securing and protec…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now