It is not all about you
There have been a number of good replies as to how you can create the technical arguments for restricting access of the users. What I haven?t seen is how to present to managers. Learning how to prepare the argument/position is a way that is ?manager ready? is something most of us IT people are not great at. We think that if we can show them the logic they will follow.
What we often forget is that managers are not dumb people. They analyze business cases on a regular basis and are looking to see the balance and trade offs. If you present to them a fully one sided view of an argument they will not be convinced. They know from their years of business experience that changes like this have a trade off, and they want to see both sides of the argument (savings and additional costs), but it is not up to them in their busy day to go and figure it out. Based on your comments about them liking the idea of the users being able to do whatever they feel like on the systems, they must have some sense that there is a business need for this, whether it is a technical need or because they feel it is good for moral to not create a difficult user environment.
Some of the things I would try to address in your presentations would be the following:
1)How often do users have an actual business need to have administrative privileges? As a consultant it would really piss of my clients if I couldn?t arrive on their site, install whatever software I needed, and get to work right away.
2)How will this increase the number calls to the help desk because users ?can?t do what they want to do??
3)How many additional people are required to address the increase in calls to the help desk?
4)How will you determine if you will perform the requested work when you get to the users desk? (?I want to install World of Warcraft on my laptop?)
5)What will be your service level agreement for performing the tasks that require admin rights that the users use to be able to do themselves?
6)If you have mobile employees, will you provide remote support, 24 hours a day?
7)Will there be any exceptions (do you have supper users in your environment?)
8)How will you address the new single point of failure that only you can have admin rights (and probably only one other person isn?t enough to satisfy a manager)?
9)How do you address (in the manager?s mind) looking like you are trying to have some built in job security as being the only one who can do this?
10)How will you let the users know what is changing and what they will experience that is different in their systems?
11)How will you make this change to all of the system in a timely manner that will not disrupt the business?
There are others, but these just jumped out at me. These may not be easy things to get a handle on factually, but if you don?t have the information to back up the business case, then don?t bother presenting it. Remember that from a management perspective it is not all about you. It is about the tradeoffs of change, and how it affects the business and users, both technically and emotionally.
