Desktop Admin and Network Security

The only concern in granting local admin rights to users is the possibility of them making changes to their computer that could cause it to not work properly. So, in the long run, you may run into people deleting things they shouldn't, etc.

As far as overall network security, you won't raise your risk by giving them local admin rights.

Hope this helps!

Ok, I am not on a 2k box, so all I can dsay is
that you WILL NOT risk the network by giving
the users a local admin, since it is exactly that,
local. Ther e si a way, however, of letting an
application run with a different privelage (ie
run as a different account (similar to running
an app on a linux box with a su)

Now, I think it is on the properties page, but I
am not sure...

Maelgwyn (who is on a mac and not a PC)

Ok, I am not on a 2k box, so all I can dsay is
that you WILL NOT risk the network by giving
the users a local admin, since it is exactly that,
local. Ther e si a way, however, of letting an
application run with a different privelage (ie
run as a different account (similar to running
an app on a linux box with a su)

Now, I think it is on the properties page, but I
am not sure...

Maelgwyn (who is on a mac and not a PC)

Ok, I am not on a 2k box, so all I can dsay is
that you WILL NOT risk the network by giving
the users a local admin, since it is exactly that,
local. Ther e si a way, however, of letting an
application run with a different privelage (ie
run as a different account (similar to running
an app on a linux box with a su)

Now, I think it is on the properties page, but I
am not sure...

Maelgwyn (who is on a mac and not a PC)

This is a common question here. Here is my view.
Local Administrators CAN compromise LAN/WAN (network) security. It is possible.
Now no, a Local Admin can't log onto a server and make changes. All they can do is anything they can think of on theirlocal machine....
And this means trojan files, password-cracking programs, mailbombers, spoofers, DoS flooders, keystroke loggers, etc. If your users have Local Admin rights, there is NOTHING stopping them from downloading some "kewl hax0r toolz" from certain websites, installing them, and running them AGAINST your LAN/WAN.
It is this aspect of "compromising my Windows NT/Win2k network security" that you have to consider, for this is a very viable and important aspect. Remember what all of the studies say, that most "hackers" are internal employees. If you make people Local Admins, then one big step is removed for them from the path to destruction.

Now, I also know of what you mean when you have applications that seem to need Local Admin rights for them to work. All this means is that you need to find all of the spots in REgistry security, NTFS file level security, and/or User Rights Assignment where these apps touch. Yes, it is difficult. Hell, I spent 1 week trying to get Crystal Reports to install and work for a normal user who I was determined to NOT make a Local Admin. But, it is possible. It just takes a while. YOu have to try all the tricks, look in all the places, because users will do ANYTHING if they have the power.

my 2 cents. Hope this helps