Security

Ask something
Discussion Locked

Local Admin rights.

0 helpful
7 replies

by rjackson

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My company is in the process of rolling out new PC's and laptop's. These computers will be running Windows 2000 Pro. I would like to put all users in the power users group but I am getting some push back from the users/managers. They want to be in the local admins group. So I am trying to findout what damage could a user do as a local admin. Not just to their local computer but also to the domain. ie Will they be able to add users or change users rights or passwords. Permissions on files and foilders. Setup some remote access. Just looking for answers on how to keep my domain/network safe.

Thx Rick

7 replies

by curacao_dejavu

locally they can do anything and everything, add other users , change permission, everything you can think of and more.
your domain would be safe as long as use domain groups and domain users in the servers/shares etc.
My suggestion is (if it comes so far ) to give them a user with admin rights and not the admin itself, so you have a backdoor).
If you are their helpdesk too, play hardball and tell them you won't support them specially if security is a issue. you won't be able to manage that so you can not be held responsible for anything that happens on the local pc's. Only on the servers.
Furthermore there are 2 security policies to download from this site, one for internet and one for network, you might want to check it out.

by penguinsrule

Greetings:

Here's a list of things that users can do that can affect your domain if given local admin access:

1) They can lock the machine down, preventing you or anyone else from getting in.
2) They can configure their machine to be a router
3) They can set up their IP address to be the same as a known router (big problem)..
4) They can set their IP address to be the same as another IP address, causing an IP conflict. (this is just a taste of what they can do in network properties..)
5) They can significantly change the configuration of their machine to the point where they can't be supported
6) They can affect critical shared data.
7) They can trash their machine on a regular basis, which means somebody has to go out there and fix it.
8) They can get in the registry and cause
damage to their application and O/S environment.
9) They can modify permissions, shares, anything related to their machine as it relates to the domain.
10) They could enable remote access, or seek
to find a way of connecting outside of the firewall..
The primary things are network properties and security issues.
hope this helps.

by mcmunt

Like 'chinachowchow' has said, local admin can do a lot. Best bet would be to find out why they want local admin rights and then give them permissions to do those things - within reason. They might only want to change their backgrounds or install software, (which can also be a problem). Limit them as much as possible, especially concerning network config. If you can't reach them over the network, it means sending a tech out.

This discussion is closed to new replies.