ok for users to be local admins?

Most people handle their own installs just fine. We setup users to be a local admin and most people will not do anything to destroy themselves.

However, you do get a few experimenters in every group. The most common thing that happens is that people will take themselves off the domain (in order to connect to a home office worgroup and backup files or offload them to another machine), and then not be able to get back on.

But, the handling of users' and the ability of them to install specific software that they need (or hardware for that matter) has not been a great problem for us. And the few who want to do other stuff, will usually check before doing anything (to make sure that it is okay).

Before you give your users local admin rights, you must know your end-users. Are there messing up the systems and you have no clear policy for re-installing a system and it takes too much workload, don't give them the rights.

There are solutions,such as:

- SMS
- GPO
- SU-account (This account make you temporary
local admin with a user acccount and after
installation of e.g. application you are back
normal user)
- Maybe Power-user is enough

Thanks for the quick answers. My users are very careful and usually do not mess with things without asking first. I think this will make our lives alot easier. Since I am still a newbie to Active Directory & Win2k, my concern was local admins might have some capabilities on the general network that I wasn't aware of.

all of the above, plus no, they cannot mess things up on the network with local admin rights. Whatever user ID is admin on local, the network settings, rights and policies for that user are set on the server and there you can restrict whatever. Theycan only mess up that particular workstation.

Well, I am going to jump out right in front of the truck and say that this is a bad idea! I personally HATE it when normal users have local Admin rights to their own machines!
Yes, the users can't break your network just by having local admin rights. They can't run "DEL *.* /S" on a server when they only have local admin rights; they can't disable a web site on a server; they can't delete shared public folders on the servers; they can't remove print queues.
All they can do is mess up their own workstation.

And to be honest, that is bad enough!!!

I don't know how many times I have heard users say things like, "I changed this setting and..." or "I installed this program and now...." or "I was looking around the system and..."

IMHO, it is a big mistake giving your users local Admin rights. If they need more than the normal user power, see if Power User status will do the job. Sometimes being a Power User will allow them to have all of the "advanced" functionality they might need. You can install as a Power User; you can modify some things as a Power User.
Yes, you can really mess up your system as a Power User, but I have seen it work so that it limits the users JUST ENOUGH to prevent regular workstation destruction!So, I am a vote in the negative for this idea, based off what I have seen over the years.

Absolute power corrupts absolutely....
user workstations!

I have to agree strongly with Joseph here...I *NEVER* make someone a local admin unless there is a very good reason. Them having the ability to tinker with their machine will make your job of troubleshooting far more difficult (and if that's what you've got to face, save nothing on the local system and just ghost that puppy back to a default standard rather than wasting hours trying to guess what they installed or changed).

We had a user who was studying to be a Network Admin where I used to work and I used to cringe every time I saw a problem with his system.

Regarding can they damage the LAN....*YES* they can. What if they install virused software? What if they change their IP to one that causes conficts with another device? Whatif they install software that impedes LAN/WAN performance (constant snmp searches for example).

I'm not saying your organization is full of end-user terrorists...but I am saying from years of experience it can sure feel that way sometimes.

;)

Good luck!

I agree with Joseph. I usually don't give an admin right for local users (Only some special circumstances)
Sometimes, with Power User right is good enough for users. They can install some programs and modify some to their pcs, and with Power Userright users cannot install programs which can alter the registry.
It is a bad idea to give your users the admin right to their local workstations. To avoid a big headache in the future, it is better for you to do it for them (install)now.
Good luck

This question was closed by the author