admin rights for executives?

You could allow people exceptions to your rule, but only if they sign off on a 'waiver' that says by going outside IT procedures, they are forfeiting their rights to support, maintenance, backup, or whatever parts you feel are necessary.

This waiver might be created where not only does this exec have to sign, but his higher up. That way the boss of that guy has to agree, and you can step in and explain to the higher up why the policy was instituted, and maybe why this guy shouldn't receive his exception. Policies are a business process, not an IT process, so make the business managers say 'no'. Let your IT always say 'yes, as long as policy permits'

I think this makes sense, and it's what we do at my institution as well. With such a diverse group (executives, physicians, researchers, administrators, facilities, etc.) we have just about every type of client you can think of. We get administrative access release forms signed for anyone that wants access, no matter their executive level. Any damage they do (installed programs, added network cards, configuration changes, etc.) are fixed at a billable rate, rather than our usual inclusive break/fix service. Also, we require the altiris management client and norton antivirus in addition to a Win2k/XP domain login for network connection; this is a non-negotiable policy due to viruses and the need to update windows to patch vulnerabilities. Executive advocacy is a must-have, not only from the CIO, but from the rest of the senior management. As long as the CIO has the support of senior management, his/her policies will stick much better, and clients will soon realize that they must bear some responsibility. I like the idea of a dedicated team for "gold" support levels, although in this economy it's not often possible to do so. We have instituted "express service" for some activities that require payment, or a higher than usual payment, for services rendered outside our supported standards or for services to be rendered ahead of our standard SLA.

As for the manager that was lamenting his 150:1 machine/tech ratio...I'm up to about 500:1, so you've got a long way to go!!

-J

Dude,
You're getting a lot of good advice here (some, maybe not so good depending on the 'culture' of your workplace). However...
You mentioned your boss, suggesting there is someone higher up the ladder than you who has a stake in the outcome of this little roundabout. I think the safest thing in situations like this is to defer to that person and let them decide how to proceed. If the existing policy is there's, they're not ganna appreciate you making an exception they are opposed to, and there is someone else, with greater authority than your self who can make the call, and therefore ultimately take the heat of any fallout (and there WILL be fallout - perhaps only an increased support workload, but fallout nonetheless).

Just me $0.02 worth. Good luck with your new headache, er, I mean VP.

O.K the exec is a customer but every service must defined boundaries else there will be SLA's anyway. The business must also understand there is a cost to every IT service they enjoy. Up times can only be guaranteed within a certain relevant range defined by the standard operating environment. There will be allowance for expetions but care must be taken to ensure that the exceptions do not become the expected! The question should be "what value does this access add to the BUSINESS".

I agree 100% with the risks of giving someone Admin rights, but what consolation is it to be right when you've got bad marks on your reputation because you're being badmouthed at exec levels, or worse - if you're in the unemployment line?

I dealt with situations like this when I was doing consulting work, and I would normally try to clear it up by:

1. Business people understand risks. Explain to him that the more changes he makes, the more he could alter the high integrity business standard you have on the systems. Explain the risks to "potential business continuity disruption" - this is where you hit the exec at his primary business function.

i.e.: is he in front of clients? "How could it affect our reputation if the system crashed during an important presentation?" If he does reports "What could be the cost of lost data if the system crashes at an important deadline?" Does he travel a lot? "How are we going to support him if he's down and 400 miles away?" "We value our ability to give good service to everyone here and I'm genuinely concerned that this could affect our ability to continue giving the same quality of services."

2. Explaining the risk of security or lawsuits - "I'm not as concerned about out time, it may be a good excuse to grow the resources of our department, but what could happen if some innocent looking unauthorized software utility installed was exploitable by a hacker and someone stole our company data from the laptop or used it to steal data from our network? What would be the perception from our clients if we had to go back and tell them their personal information may have been compromised? What could that do to our corporate reputation/stocks? What would be the cost of just one incident? Not to mention any potential lawsuit risks?"

3. Explaining the increased cost of support. "We would be happy to give increased rights to these users, but we may require additional support staff to handle the increased support requirements." Maybe even mention to help reduce downtime you need a "spare" system of that type! Or propose using a user based recovery system (like xpoint). Be prepared with some statistics, costs and nice flashy graphs to illustrate your points! Nothing brings this "give me rights" game to a halt faster than showing increased costs without increased benefits to the decision maker!

If the CEO/President says "go" then give it to him and thank him for the time, and get some additional equipment and put an ad on monster.ca for another tech to grow your department - and look at the bright side. My experience is that most likely if you talk to the big cheese in his language (costs and risks) that this will all come to a screeching halt.

Either way - good luck with that! Political problems at the exec level are tricky at the best of times.

I work at corporate. all the execs "needed" full admin right to their local machines. Our new CIO put a stop to it and had us lock down the network and migrate to pure Windows 2000. Now, not a single "C-level" executive has admin rights. Anybody else who asks is directed up the chain until they reach our CIO. This greatly discourages these requests.

Execs are employees just like the lowest person in the company. The IT policy is designed to protect the company from IT problems. Therefore, since the Execs are employees of the company, they need to follow the same rules as any other employee. PERIOD. END OF DISCUSSION.

Seems to me any decent manager wants to set an example for other employees to follow. This guy should be asked to do that by abiding by standard policies.

I don't like this, but by boss took care of a similar problem. He granted the exec the admin privledges requested, then about a week later went into the hidden C$ share and deleted a couple of files. When the exec complained to me that the files were gone, I reminded him that only server shares were backed up, and that if his local files couldn't be recovered, they were gone forever. As I said, I don't like this, but it sure worked! (My boss, for whom I have a lot of respect, did not set a good example here.)

The IT policy was put in place to eliminate rouge users from contaminating the network. It was (in most corps) signed off on and approved by the high up execs.I would take his request to the (have my boss take it) president or highest ranking copmpany officer that I could get it in front of. Explain to this officer that one breach of security could cost the company hundreds, thousands, or even millions of dollars. If he says to give this guy full access then I would have him sign off on his decision placing him and the rouge exec at risk to pay for any loss accrued because of this person. I would also have the rouge exec sign off agreeing to pay any damages caused by him having full access to the rights on his computer that he is connecting to the company network.

Michael

Thats My Story And I'm Stickin To It

First, policy is not signed by me the security officer as I'm not the owner (CE0, board of directors, etc.). The owner is the only one who can sign formal statement of rules that everyone in the company must follow. I write the procedures that implement both physical and logical controls based on policy and risk, which are both signed by the owner.

Second, this owner signed policy applies to everybody in the company, including executive VPs. Selectively applying policy is known as discrimination in a court room setting and can lead to wrongful termination law suits. Not applying policy at all is called implied consent in that same court room. Which problem does the owner want to potentially occur?

Third, what this all means is that the owner has to 100% support the policies he or she signed off on. If you are the one who signed policy (not procedures), then you have no hammer to apply to anyone in the company who violates that policy. If the owner doesn't really support policy, then you have no real hammer either, but the company could have some interesting days ahead in the business arena.

Lastly, if this exec has a business case for needing admin privileges, then let him present it. If approved by the owner, then give him security and admin training. Have him sign off that he is aware of his responsibilities as pertaining to company policies and procedures. Now he's responsible for any screw ups. See how he likes that :-)

I work for a moderate sized Gov't entity. This limits our ability to bill someone for messing up their computers.
Dept policy states that users shouldn't run with Administrative access unless there is a compelling reason.
We have a few people (who previously had Whine 98) with new WinXP laptops. They were set as "Power Users". They complained they couldn't make certain changes to their computer because the changes needed Admin Rights.
What we did was to create an account called "Installer" on their laptops with Admin rights. In order for them to get the password, they had to sign a document detailing:
- why you shouldn't run as an admin
- it is in violation of Dept Policy to install unauthorized software, either from media or downloaded from the Internet
- you won't change your own access level
- you will not change the administrator password
- Violations of those (and other items) could result in loss of the special account.

The only problem I've run into with this is the software for one of the PDA's didn't want to cooperate. Normal user account couldn't install it. Installed with the installer account wouldn't run with the normal "JoeUser" account being active. I had to upgrade the "JoeUser" account, install it, and then down grade the account back to Power User.

TTFN

1-dont break your IT policys for employees.
2-Give the big shot power user status, -make him feel important.
3-followe rules 1, and 2 and enjoy less stress and micorsoft based headaches in your life.

Don't do IT because if it gets around the next SVP will want it and then what about VP's and can you really stop Directors and Managers if VP's and SVP's get it. And what about that EVP that's son showed him how to take the cover off of his PC to add memory? Where does it stop?

That's why you have policies. If you are having problems with that YAHOO, then talk to the Chain of Command and let that EVP or CEO do their job and tell this SVP why you have policies. Be ready however to support their needs. We in IT cannot hide behind our policies so that we don't have to do something. If this person needs support, that's your job, meet their needs and then they won't have any reason to ask to go around the standard.......good luck...........

I don't know the structure of IT at your company and where you report on the org chart, but...

If you've got a CIO at the VP level, a chat with him/her about this would not be out of the question. Get your reporting VP in your court on this, and then let the issue be dealt with at that level. The last thing you'll need is to have spats like this going on between yourself or your manager with a VP.

If you're VP is the CFO, you will have a harder time explaining the issues and winning them over.

Just my $.02

Since the company owner won't take responsibility for his own inabilities or errors, he blames the computer. Therefore he gets a new one, and I inherit the old (1-2 yr old) laptop. A quick rebuild and I have a new toy.

The first rule in technology is eat your own dog food.

If you have given up administrative rights to your laptop, you should have no problem convincing someone else to.

If you haven't, you are a hypocrit and frankly a micro power freak. Don't ever impose a rule on someone else you wouldn't be willing to live with yourself.

We have a number of staff positions dedicated to managing *exceptions*. We negotiate with the exec's staff to determine the exceptions and determine who will be taking advantage of those exceptions. A service agreement is signed, and they go on about their way. Currently, out of 100k users, we have only 7 of these individuals.

Mrafrohead...
This is perhaps the most ridiculous over generalization I've read in a long time. Obviously the exec is "dumber than a post" because he is probably making 3x as much as you are with the apparent attitude problem that you have. The other guy who wrote about prosecuting the guy for Cyber terrorism if something "got through" is also someone who has an inflated sense of his own self worth within the organization. You are there to help people, not threaten them... Maybe a little education on how to not do something stupid would go further than the threats.

One thing about a use policy for the department, if it's written without room for exceptions, then you might be locking yourself (and the company) inside that proverbial "box".

Giving certain individuals rights that supercede their normal group assignment might be what you need to do in order to give them the freedom they require to innovate. Of course, it can also cause a lot of trouble for your support organization, which is why you have to evaluate each request for extra rights independently and in its proper context.

What would be the downside of making this exec a local administrator on his own laptop? I'm assuming that you have some sort of "watchdog" or "spyware" running on each client machine, to monitor the exceptional circumstances. Is he clever enough to realize this? Wouldn't you still be able to monitor his activities? As a matter of fact, you could make the local administrator status contingent on the user being constantly monitored, and let him know that. Give him one chance. If he screws up, then he reverts back to the pre-defined management role. And OF COURSE he's held responsible for EVERYTHING that happens on his laptop once he's a local admin, whether or not it's his fault. NO, he doesn't get preferential treatment from IT support -- after all, he's a local admin, he should be able to troubleshoot his own IT problems, right?

We had our VP of taxes try the same thing with his pc and his sonic wall at home. He kept messing up his system so much that I changed the passwords and he has to go through us for any changes to his pc/security system. The lesson learned by all was to stick to the policies because they were established for a good reason. Would he want you messing around in his office and change how he does things?

I can't understand why anyone would impose such a ridicules policies.
This only shows how lazy this IT team and it also show their lack of creativity and innovation.

HAVE A NICE DAY !!!

Procedures are often like the law: No one is exempt but there may be valid reasons to allow an individual some latitude. As an officer of my union, I am given admin authority over my workstation simply because 1.labour Law protects confidential data.2. my workstation is used only for union business 3. the company provides the workstation under the terms of a collective agreement. Similarly a human resources professional may need admin authority over her workstation due to the confidential personal and labour relations information that is stored there. Each request must be evaluated on the basis of need, taking into account not just corporate or departmental policy but also legislation and contractual obligations. A serious legal exposure could be created when policy does not allow for evaluation on a case by case basis. On the other hand, just because someone says "I'm higher up than you so you have to listen to me," does not automatically mean that you have to risk your own job by violating a clearly stated policy. The issue should be referred to someone in higher autthority. Keep written records of all discussions and print hardcopys of all communications on the matter. Cover yourself by using due dilegence, by asking for a second opinion from your own boss and under no circumstances allow your personal feelings to enter into the discussion. Accountability is the key. It's just good business!

Well, the way I look at it is that anyone who is competent enough to trust with administrative privileges won't have to ask - they can just blast out the administrative password on the local machine, and do whatever they like.

So, you've determined by the simple fact that they asked the question that they don't merit administrative privileges... Here is what I do - I give them a local administrative account, never never never an administrative acount for the domain, and let them do their damnedest. On XP I'll set a restore point, on earlier OS's I'll copy the registry hives, or in some cases create a system image.

A lot depends on your relationship with the person - if it is a bit adversarial, then they will blame problems on your "incompetence," and try to undermine your credibility at every opportunity. The key here is in relationships - make yourself this person's ally, keep documentation, but keep it to yourself. Dialogue with them, explain to them the destructive forces to be reckoned with, and the risks involved...

But if we are taking about logging on to the domain with an administrative password, NO WAY,

That is an excellent piece of advice for larger corporations.

It justifies the policies in place and makes IT's job eaasier in the end at the same time.

Brilliant.

it's not about squashing your eog, Hiro_P... It's about what's best for your business and that's not always giving in. What if everyone asks for the exception? What will your reputation (and your dept's') become after all the VPs have total access and screw everything up all the time. If the ego-guys can't deal with a little IT policy, then they're not going to admit to anyone that they screwed up the computer--you'll get blamed for all their problems. So, you'll be looking for a job anyway!

Reread the messages about working with the higher levels of the organization, creating an 'exec support' person--hey, even create a "charge back" policy where your dept gets to charge the execs for "out of the ordinary" fixes due to out-of-policy access. But just don't just consider giving in without discussing the business needs, ramifications, and costs with higher ups.

This is my idea for you:
I agree with the idea that a face to face meeting with the policy manual right there with your boss and his and explain to him that these policies are there for a reason then do the following.

1. Provide an itemized bill showing the VP exactly how much it would cost him to repair the problem(s) he created through his mistakes.

2. Tell him that he must pay for those mistakes from his own pocket, not the company's account.
This should hopefully make him think very hard about the potential out of pocket cost if he messes up.

Like the others in this discussion, there is a major security concern with unauthorised software, copied or unlicensed. The downloading of software from the internet, specifically any peer to peer software which could allow anyone outside the company to look at, modify or steal company data. Explain to the VP that he would be held legally responsible for said attack with the possibility of being finacially responsible for said breach.

I believe that policies are made for a reason, checks and balances. I don't feel the IT department is lazy implementing such policies, but it does protect everyone one in the company to ensure data and equipment protection. You are always going to have some ego-managers that think that they have an a piece of paper that they can request such riduculous things. Policies should be stated and implemented as soon as a employess, IT, Management or otherwise.

Good managers should and need to understand why the policies are in place for all departments, not just IT, and should be in support of the policies departments setup. If there is a disagreement, everyone should discuss those issues. However, you always have some power tripping manager who thinks they can go over anyone anytime they feel like it.

I have one client who's sales manager USED to be their net admin, he knows SOME stuff but also knows what not to get into, therefore he has admin rights (remember, it's NOT MY NETWORK, it belongs to the company). I had cleared his want for rights with HIS boss and also explained it MAY be a problem but he assured me it was ok to give him the rights. Remember, these guys are responsible enough that if they demand admin rights and then screw up the network, it isn't my fault, the company owns the network and simply pays me to fix it. If I submit too many bills for fixing up some managers problems, HIS boss will talk to him about it.

In your case, I assume by wannabe, you are referring to his network knowledge. For some reason, ANYONE, regardless of experiecne, that is not hired directly to handle a position is considered a wannabe. I find many IT staff have their heads in the clouds most of the time when it comes to their importance to the company wheras in reality anyone can be replaced in a heartbeat, don't think you can't because you can.

So what I'm getting at here, the bottom line, is that no matter how important you feel you are, a VP will do as he chooses and you are simply paid to accomdoate him. You can suggest that it is not a good idea to have loose access policies bvut in essence, if the SVP decided to purposely screw up the network and create two weeks work for you, that's his choice and you simply have to do the work you are being paid to do.

If YOUR boss wonders why all this is screwed up, you just have to say, the SVP insisted on having full access rights despite your recommendations not to. You are now off the hook.

No matter what gets screwed up, it just keeps you busy, you get paid by the company to keep things going and if they die to fix them. I don't see why this issue comes up ALL THE TIME here.

IT STAFF ARE SIMPLY EMPLOYEES, don't forget your role and remember that it's just a job and you get paid to turn up and keep it going. If you don't like it, there are MILIONS of MSCE's waiting to step in and take over. IT staff, salesmen, janitorial staff, shipping staff, production staff it is ALL THE SAME. You are an employee that is paid to perform a job, if your job ALSO entails decidig WHO gets what access rights and you are concerned, relay you rconcerns to the powers that be and see what their response is. If they say go ahead, then do it. If it costs the company money, it's THEIR headache and not yours. I see so many people trying to accept responsibilities as if the network is their own or the users are all idiots (which I agree many are).

Worst case scenario, this guy is gonna bring you some overtime so you can buy the wife dinner and a new dress.

Easy, just demand that you should have the right to make any financial business decision even if its not related to IT! After you get a quick NO. Ask why?? He'll probably quickly realise why he shouldn't have admin rights.

He won't hang himself. He'll hang you. Even if you have enough documentation to convince a US congressional commitee, you'll still lose, because he is the VP and is "in the club". A gent that I once worked for said that "VPs are not your friends or your buddy. They're different."

I'd re-read the message I posted earlier today. If he's coming directly at you, he's using his using, no wait, he's abusing his power to scare you into doing what he wants.

Remember, your primary responsibility is to the company, not the person(s) you work for or the person in the office next to you, but the company. You have to do what's best for the company.

As I said...I'd re-read my earlier post and take that action. Let it be duked out at the VP level. If he comes at you again, tell him he'll have to take it up with your reporting VP.

Inform your CIO and let him/her do their job, which is to deal with other executives on matters such as this. They don't pay you enough to fight these battles; they DO pay the CIO enough.

My county has a computer policy, and every employee, regardless of their position, MUST sign it. In the policy it clearly states that only IT has administrative rights on our domain. Experience has demonstrated time and again that an employees will add software that sounds good in theory, but in actuality are simply headaches. Your new VP sounds like he's in that category.

No, We don't.

Admin rights presume, among other things, that a user desires to install software. If it's company issued, supported, and expensed; that includes any software that is placed on it, too.

If an exec has a business reason for something else to be installed, then that's possible. And in those cases, you may/may not grant the company licensing, installing, and supporting the app depending on you're wishes and how much stink it'll raise. But I say, stick to your guns and keep those instances low or non-existent.

The solution that I have used in the past that works with demaning Exec's, is you give the Exec's 'Read Only' access to the network, and you set up your policy so that they cannot copy sensitive files off of the network. With 'Read Only' you have no fear of them changing anything and with no copy, they cannot take anything out of the office.

We have a policy for executives that gives a little bit of flexibility. For any exec that wants to have those rights, we give it to them. The caveat for them is that IT supports ONLY the preinstalled apps. Any issues related to non-supported apps are handled by the exec. If the app causes an issue with supported apps the offending program is deleted. If the problem is not solved by removing the program, the computer is reimaged from a generic Ghost image. If the exec is willing to abide by that, they are give access. This only applies to Senior Executives, ie, officers of the company.

This is in a Fortune 500 company.

Most execs that I have seen in this company only care about one application: e-mail. As long as they are able to communicate using e-mail from the office, home, hotel, etc. The only other type of software most require is MS Office or some other kind of work processor or spreadsheet software. It's the other workers' that I fear, engineers especially because they think they are technical savvy and can load and troubleshoot software on their own.

Just want to say from my expirenece as a LAN Adminstrator, I never had a problem with giving administrative rights to my to end user's on the local machine....once I get to know them. Local rights is the safe why to go about it.

Best for laptop users.

Please keep in mind once the user logs on to the network (Domain) his/hers rights are limited, they will have to log on to the local profile on the local machine to make changes. By granting the above rights will keep your network infrastructure safe and secure.

However you might want to start by giving the big dog rights as a Power users in lieu of Administrator. Be easy on yourself get to know the user first and analize his or her needs then give rights accordingly.

Hope this advice helps!!!!

Best of Luck !
LAN Administrator
Samuel Ramos

Exactly he will not hang himself the only one he will hang is you.keep in mind he is part of the millionares club. He is a great producer, and his colleges will take his side before they take yours.

Word from the wise... the last thing you want to here is.... you dont know what your doing.

Exactly he will not hang himself the only one he will hang is you.keep in mind he is part of the millionares club. He is a great producer, and his colleges will take his side before they take yours.

Word from the wise... the last thing you want to hear is.... you dont know what your doing.

I have to disagree with this statement. No offense but when you are a LAN Administrator everthing falls on your lap.

So be prepared for the responsibilty. Before allowing a user full rights to the PC, you should always make it clear to them that you will not be responsible for the personal data and software on the local machine.

As we all know all end users should be saving company documentation on the network for daily backups.

...and I see EEBYWATER out of a job pretty soon.

Two rules of business"
1. The boss is right.
2. See rule number 1.

An executive has earned the right (or at least, has been given the right) to be boss. Whatever that executive needs should be one of your top priorities (even if it is wrong)... unless you can prove otherwise without upsetting the boss.

As an IT professional, you should be able to devise backup and access rights that prevent "ANY" user (or hacker) from destroying critical systems and data.

Sure the exec can be given admin rights to their own system, but Standardization, Backup, Training, Redundancy, Disaster Recovery, and Policy Exception options should in place to protect users from themselves, instead of the "hard nose" tactics that keep Executives from "owning" their system.

IT is a Service Organization! As an IT Professional you should provide "SERVICE" to any employee that qualifies for your services.

As an IT manager, my techies were required to fix, or replace an Executive's system within 20 minutes from the time it was reported. The methods mentioned above allowed us to do just that and "good service" gave us the confidence and respect of the Executives. They were our friends ... not our enemies.

After all ... the Executives are the one making the big bucks and policy decisions. They also control the IT budgets and your destiny at work.

Look at it this way: If it is EASY for you, you are probably making it more difficult for the users. Make it EASY for the users ... then you are doing your job as an IT Professional.

You are hired to give options. We are hired to protect the computers, networks, databases, privacy, reputations, etc...

BIG difference.

By not protecting our "customers" we ARE NOT giving them good service and we are not doing the job we got hired to do.

This is a difficult (but fairly common) situation in the corporate workplace. You are right to try to hold to your existing I.T. policy for all corporate staff - REGARDLESS of their rank or position. Occasionally, executive privelege has managed to override I.T. policy in corporations that I have worked for. When that has happened, our department managed to get a SIGNED agreement from the executive that he accepted full liability for his data and operating system and any / all subsequent support problems would be queued / handled through the basic helpdesk system with NO SPECIAL PRIORITY. Furthermore, any non-standard installations or repairs would be directly billed to the executive (not the I.T.) budget. Essentially, we told the execs that they were stepping outside the I.T. department's ability to support his system in a timely and properly budgeted manner and that s/he would have to accept full responsibility for that privelege. Many execs, when facing the situation in that manner, will back off into corporate compliance. A few that I recall decided to "go it alone" soon gave up after a few bad experiences with trying to "outsource" their corporately customized configurations to an unfamiliar consultant or repair shop. Good luck ...

I find it hard to understand how this could ever be seen as "servicing the organization". It is simply cowering to the demands of a person who does not understand IT or care about the risks.

You are hired to do a job and allowing someone to jeopardize your job and the organization because of their position does not seem like a good service.

All the disclaimers and "I told you so's" won't keep these people from firing you even if a problem was their fault. If they mess their laptop up before a big meeting and their ppt presentation won't work, who's name get's negative recognition in front of many - theirs or yours? If you are going to get fired anyway, why not take the high ground and do what is right for the organization. When applying for the next job, I would feel better explaining that situation.

Exec's have to look good and the way they look good is by you providing true professional computing support and protection. This includes limiting admin rights to only those who are competent and trustworthy enough to handle them. Most of all it includes an active and ongoing training program to keep everyone up to date on current security risks and threats and how they can keep their computing environment safe.

Fortunatley, most execs I have worked with understand their limitations of IT knowledge and know exactly why they have an IT department.

Whenever you do help, you must not let your ego in the way as well. We can all fix the broken parts, but it is better to prevent them from breaking.

You are right he does not want to follow IT policy because it makes him feel inferior. Try to take this feeling away from him by explaining to him in laymen terms some common hacker techniques exposed through assigning admin rights to ordinary users (i.e. vp's and all the above, lol)

Of course he will probably brush hacker talk right out the window which is what the hacker...

well good luck!!

With few sad exceptions this is not about a power grab as some have mentioned. It is about performing our tasks, duties and responsibilities properly.

The "reactive" IT methodology is what allows a virus to spread around the word in seconds and IT depts to get a lot of overtime pay, unless of course your on salary like me.

The real problem for some is understanding the true hinderance to use your words. When we use SPAM filters and they catch one valid email that was important. Did the IT dept cause the problem or the fact that SPAM exists cause the problem.

If an exec can't access information that exists on a known problem server because we have blocked access via a firewall. Who/what is the real problem here.

Helping all users to understand what they are being protected from is absolutely necessary to eliminate almost all problems such as the one being addressed here.

Also being able to show the $$ saved due to your efforts wins the heart of most execs.

Words of wisdom: Business Justification

Thank you Russell.

The VP clearly has no direction with which he wants to take his PC. He just wants admin rights to defeat his inferiority complex. This is a seperate issue, not a justifiable business decision.

Remeber there are wannabes out there and they will always be wannabes.

Sure give him admin rights for his pc. Take him to the users account and show Mr. Big, look sir you are an administrator. Make him feel important. Restrict him on the server side.Restrict him with group policies and local polices. Definately do not make him part of the administrators group on the server.

And another important point is that your boss understands that IT is not on a power trip but that it has the best interest of the company in mind.

Fortunately most execs I have worked with have this same understanding.

... and an experienced is worth a million.

I worked in a company where we had one of those hard cases. The guy in charge of network security and policy finally let the exec have his way. And then hacked into his notebook. Nothing serious or harmful, just messed up his screensaver and sounds (it would fart every time he turned it on and burp for mistakes). And he also trashed his porn (oh yeah, that's what he wanted to install, Kazaa). And demoted him to guest status so he couldn't change anything back. How he did it I don't know, I'm just the guy who sets the hardware up, changes faulty kbs, disks and monitors, and he wouldn't tell me...
Second time, he had his way, and the exec gave in.

If you are dealing with a senior exec dumb, er, i meant unreasonable, enough to think he/she knows better than policies, you should be ready to be held accountable for the mayhem he/she might cause, locally or all over your net.

Specially if this is not really an IT-educated person, which is almost always the case. Or even worse, it might be a half-cooked IT-wiz wannabe.

He (why don't English have a neutral pronoun?? I'll say HE but remember, women can be unreasonable too. Not saying that happens often though).

He will never admit it's his mess. Somehow you should have managed things so he could have had administration rights in a completely sealed-off secure environment. After all that is why they are paying you a salary, right?

How to avoid that? No specific way. Each case is different, specially if you don't have higher-powers backing (and that is surely the case, or we wouldn't be discussing this).

I agree. Be ready for damage containmet. But do not, repeat, do not be surprised if instead of Christ Reborn you are treated more like something the cat dragged in. Egos don't like to be proved wrong...

I am the Sr.VP of the company that employes you. I ask you to do something and you raise an eyebrow.

You sir need to go home and pick up a paper so you can find work, I'll have your separation papers ready in the morning.

I Agree with " clamo88 ". If you Submit to His Requests without Discussing the Matter with those in Charge take a guess Whom they will Blame when things DO go Wrong. So prepare 1st then Discuss the matter, ramifications, and costs then go with Their Recommendation. " Let the Boss have the Final say "

If you are in a big corporation you can easily claim that you are only following rules. However, you should cover your back and have your supervisor take the issue up the chain to someone that is this guy's peer or better and get an answer after that person has been given the facts as well as the caveats from a legal perspective, etc. Let them decide the issue, you will get paid the same whether he is a local admin to his laptop or not, but if you are the one that decides he can't have the rights and you don't cover your back then you will still get paid the same, only now it will be $0.00.

I work in a smaller company and I pretty much set the rules as the Director of I.S. but if one of the owners wants to do something on his computer that he can't I give him what he wants and if it is a danger I make sure that he understands what that danger is. But generally I try to only give them enough rights to do what they want to do.

For the most part no one has even Power User rights, all used to when I came on board but since rebuilding the shambles into a real network and locking the important things down the problems have become much smaller and less frequent than they used to be.

Laptops are different, only the President and the owners have them and they have a username to use to get admin rights if they want, but are advised not to use it except to set up printers, etc. and I encourage this by making the password very difficult to type for the admin rights user. These folks are lazy and will use the account that is easy for them to use.

One owner has "blown up" his laptop at least three times in the past year, each time telling me the laptop is junk and to buy him a new one. Happened again early this week to the laptop that he bought (told Best Buy to sell him the best they had) because he was too impatient to wait as that last laptop got "blown up" on a Friday night. Currently the "new" laptop he was given yesterday is actually the same one he had before the one he just "blew up" but has since been FDISKed and reloaded and I get a good laugh everytime I think about him telling me today how much faster and better this "new" one is than any of the others. I secretly wonder if I could give him an etch-a-sketch like Dilbert gave his boss (smile).

The owner of my company does not demand administration rights, but asked for them recently. I gave him 10 situations from his past where he would have cost himself tens of thousands of dollars as a result. He has also proven he can not abide by policy, so if I gave it to him with him promising not to use it or stay logged in with it in User mode, I know he would.

The way I approach it is if you want me to remain your IT guy, absolutely nobody except a Professional will have that password. He tried to uninstall Spyware protection two weeks ago thinking it was Spyware but couldn't due to his Domain User account. Thank God! I could go on and on and on with example after example of idiocy, translating it to costs and downtime. This is what I do when he or one of his "Directors" broach the subject.

The day they have the Administrator password will be the day I leave.

Oz...the horse of a different color comes to mind.

Our top priority is to protect the data. The data pays our checks. Executives comes and they go. The data and their equipment comes back to us. We are the gatekeepers. IT policy, particular security polices are in place to protect the data, thus, securing Payroll, Gods of the check printers.

RakeHell

We found an executive that installed unlicensed software on his company laptop. We discovered it by accident while auditing software on the network while he was connected. This is a tremendous liability and can cost thousands of dollars per occurance. All permissions were removed and the software deleted.

I've done a lot of hardware and software installation and repair, as well as network management. I used to do the direct user support for about 100 users. Unofficially, as it wasn't my job, but I was the one everyone came to because I could usually fix the problem. I did the triage. If it was hardware, I called the overworked techs and told them what was needed (I was usually right--the techs asked for "second opinions" from me, too). If it was software, I either fixed it or, if the system had gotten to "cruft level 5" and above, it went to the official techs for a reblow.

About a year ago, I transitioned into a job in another organization where I was relatively senior, and could leave the user support behind (they have a larger, better tech staff than I was used to). However, *I* wanted admin rights to my XP laptop. My old organization had gotten tighter and tighter, pulling all control into the national office, to the point where they had a mis-set switch in their XP install that caused a long-time app (an app managed by the same useless national office people) to misfunction in a very annoying way for every user in the country. Everyone, including the local techs, was locked out of the setting. I told the national folks that there was a problem, and what and where it was and what to do to fix it. Over a year ago. It's still not fixed. Everybody's still using kludgy workarounds and wasting time. I will *not* stand for that on something I'm trying to get work done on. Maybe I'm funny that way, but I think technology is here to serve *me,* not the other way around!

I fully understand the implications of taking on admin rights (hell, I still administer a couple of networks on the side, one a mixed-platform), and I'm exceedingly careful of what I do--and don't--install.

But I also know I am, by and large, the exception, in that I *do* understand the implications, so I'm pretty careful.

I understand wanting admin rights (which, by the way, I was given by my new organization--without having to raise a fuss). I don't want to be balked by someone *else's* ideas of what I should and shouldn't have on a machine only *I* use. But I also know that it's a recipe for disaster for many users. It sounds like it may well be for the boss described. I agree with those who are saying "give it to him, but make sure he's agreed--preferably in writing--that, if he screws it up because of something he did, it may be a while before it can get fixed." I don't think that's at all unfair to ask, and I think if you can present it to him as an issue of fairness, he can probably be persuaded.

Dealing with Executives can be very touchy.
I support the executive staff at my company and know first hand. I feel for your situation. As I.T. Professionals we all know what the right thing is. I have worked at places where I.T. has teeth and things seem to go much smoother.
I think the smart action in this case is as others have suggested: send the request for Admin rights up the chain of command. After all, you don't get to pick and choose who gets them and it takes you out of the line of fire. Unfortunately the top I.T. person in my Org reports to the CFO and there have been many escalations that have not gone the proper way.
It sounds like your Company is the same- so be prepared to carry out whatever is decided (and preferrably get it in an email in case people "forget" who authorized it). I would also suggest a good recovery plan. I try to treat the critial machines as if they were servers (spare hardware, automated backups, etc..) I ghost most of the critical executive machines every other week as access permits and this has saved time/money for all involved. As the front person representing I.T. to our executive staff I feel providing the best level of service as well as being honest about your work will earn you respect and trust. There will always be the primadonna's and Egomaniac's but overall I have worked with some top notch professionals. You will always lose in a battle with your bosses, bosses, bosses, boss- even if you are right!
Just my 2cents worth.

Hi,
if u r using Domain policies, then Pls go to ur Administrative tools, Active Directory Users & Computers. In this section got to user section. U will find a user entry as Default OU policy deny.
Add the computer's entry into the Member section.
Then go to Worstation section & select the computer name u entered in the previous stage.
Here right click on the name & go to manage.
In the manage option, add the user to the administrators group. restart the pc & ur problem is been solved.

Generally we don't give these rights to the users using pcs,but in case of laptop users, yes sometimes we have to be flexible.But the user's admin rights r limited to his pc only. So there is no problem in going for the option. After all it's ur decision in the end.

I have found over the years that if you sit down and build a case on why they shouldn't have access and then talk to the VP who says they need it and explain why. If this doesn't resolve the problem explain that this is a company policy that if changed for one person could cause harm. If that doesn't work go over his head.

You say he has a huge ego? I hate what I'm about to suggest, but try a "suck-up" type routine-- play on his importance and the fact that his time is better spent working his job; the "small-fish problems" that he finds on his laptop are better suited to those of you who are more familiar with the new complexities and nuances of the new O/S, etc.

I once worked for a company with a BS (boss's son) who thought he was the last word in computers. At a time when there was only one PC in the company and I was working on the Quality Assurance Plan (required by the state license), he locked the hard drive and left for a week. Later, when we got a LAN and someone else in charge of that we pretty well kept him locked out. Believe it or not, he eventually got himself fired-- but that's another story.

Laptop users often need the ability to configure communication devices (modem,network,firewall,...) when travelling.

Giving them admin right is dangerous because they are more likely to be attacked while not in their secured office.

I would create them a local administrator on the PC that will allow them to do any change (they could even 'run-as').
As this admin is local to the PC, it won't have access to the network, reducing incidence.

This is not the ideal solution, but I find it better than giving local admin right on a domain user.

What I am hearing is a lot of control issues. What you have to remember is that IT is a necessary service center for a company, the key word being service. When you have a request that falls either outside policy or somewhere on the edge, your job is to evaluate the validity and provide an informed recomendation to your supervisor. Don't assume that someone doesn't need something just because you think they are not as knowledgeable as yourself. Different functional divisions of a company will have different needs i.e. executive, accounting, engineering, etc. I have seen companies that won't let engineers install thier own software, and on top of that it takes a formal request and at least 2 weeks to get the software installed. This is completely unacceptable. If you are going to deny a request you had better make sure you can properly support the needs of this individual.

One of the comments refered to the company network as thier office and "he wouldn't wnat you messing arround in his office?". Something to keep in mind is that the individuals PC has become the majority of his office, i.e. desktop, filling system, address and appointment book, etc. By limiting his ability to customize his computer you are in effect telling him what tools he can use on his desk.

I have Admin rights to my laptop and in the last 3 years I have installed hundreds of software packages, and none of these have created a problem that required IT intervension.

1) I'd have this new senior VP get at least one higher-up to approve the request.

2) I would not give the Admin-wannabe the Administrator account and password.

3) See if you can determine specifically what he's trying to do, and enable just those authorities.

Policies in some organizations are only there to appease auditors. They only apply to those below Senior Executive Officer and in some cases below VP. When challenged with written policy in front of the CEO, he states we are not being flexible enough and that the SEO's are who pay our salary and they are allowed to do whatever they wish and we are to support no matter what. If they break it, our job is to make it right!

>>he insists on having admin rights to his W2K laptop because he needs to "control his own destiny on the computer" pfft...

Don't be so hard on him! In fact, he should carry this philosophy over to other areas of his life. He should insist on piloting every airplane he gets into, so he can "control his destiny in the air." (instead of leaving that little chore to someone designated by the airline, for his own safety and that of others.)

He should go into the kitchen of every restaurant, elbow aside the cook, and "control his destiny at the table." And we haven't even thought about installing his own furnace, air conditioning, or acting as his own attorney so he can control his own destiny in the courtroom.

We depend far too much on people who know what they're doing and have been duly appointed to perform their expert tasks. Why not have chaos and anarchy instead? I'm sure it would make things more interesting.

(Ironically, that would result in LESS control of our own destiny as we waste time and resources fixing stuff we could have been using to do whatever creative thing was on our agenda...)

Give him Admin rights: but first require him to obtain the same certifications and training that you other I.T. people have who hold desktop admin rights. This preserves your policy and you have not Denied his request

It would not give him the acces rights, as in most cases he does not need them, and as said before by otheres this is just aego thing.

If he really wants them then the best way to do that, would be to write a explicit policy/procedure for enlarging executive rights, that stipulates exactely waht the consequences can be of misuses.

He should be made aware, be explained and read and sign a document that explains him what the code of conduct is for laptop users, what his responsibilitys are as a exutive. Regarding the physical safety of the laptop, the backing up of any data, following standarised procedures. It is most importantly that he signs this. Then best would also be to check this with HR, and let them explain him what the sanctions will be of misuses or not good care.

I would not give him excutive support, as you might then end up with on person of your support team mainly supporting that person.

One other alternative would be to let him sign a kind of contract, that explains the levels of priority of probelms (service level agreement), and gives him a certain time like kind of expected monthal support time. You can then adjust this to his needs, but you can also use it show him that e.g. he recquires exesive support times, and that he should stop playing with his laptop but use it for work.

The reason I wrote previously that you might have to talk this over with HR first, is that from personal experience I know that data is not always fully backed up, password are not kept secret, laptops are not taken care of in the way they should be.... It might be necessary to remind him or include it one of the above papers that laptops cost money, that if he loses any data because he didn't back it up or followed the procedure it his fault and he is responsable for it... and if this happens regulary, it might be necessary to check if its not better to give him a desktop. Or let him follow computer training together with other people of the company.

He should be made aware that with a higher title comes a higher responsability, and if he really wants the rights he can have them. But if I was him, I'd go for normal user rights, thats a lot less fuss.

This way, he knows what is expected of him, he has signed and agreed on it, and you are covered.

My vision for support is that one should try to prevent problems from happening, and calls from happening, and that one should if problems do arise (and they will) they should be dealt with in a proactive way. Communication should be clear, and standarised.

But hey, I shouldn't be telling you this, you already know this, you wouldn't be on thech republic otherwise.

hope this was of any help.

What we do is make the person sign a waiver granting him admin rights. On the waiver, state something like this:

You have chosen to receive admin rights to your pc. Please keep in mind that you will be more suceptible to viruses, spyware, trojans and system crashes...etc. By signing this waiver, you understand the risks of having admin rights to your machine...IT will continue to support your machine however you abolish all liability to IT in case of system crahses or data loss...

blah blah blah...worked for us.

The problem is not give admin rights to an executive into the organization, the real problem is when the user make changes to his computer and this changes make the computer get damaged and then its come with more things to be worried for the It department. I think is good give admin rights to this kind of executives, but with careful, the IT department should have good restore best practices for this cases.

Hi Dumb User

I understand your query regarding security restrictions, it can be a bit of a pain initially, although I am sure you can appreciate the huge task the support team has managing hundreds of different PC's, Servers and Laptops. We have found maintaining the integrity of the operating system goes someway to assist both the end user and support team.

If you find you need to install additional software or devices please feel free to request this through helpdesk@mycompany.com and the team will be more than happy to assist where possible.

Thanks
J Doe

If your boss has the political clout, and your company takes security seriously, no admin rights.

If your company is stupid, give the executives what they want. These companies like "Yes" men despite whatever they tell you and you are merely the puny little pebble in their shoe that will be crushed anyway. Prepare to be Enroned.

We do NOT usually allow executives administrative rights on their laptops, but have made a few exceptions for the top executives, i.e. Lt. Governor and CEO, to have admin rights over their "local" account only on their stand-alone laptops. They travel extensively throughout the world and from time to time have needed to install something in order to be productive. It's a lot easier, and safer, to do it this way than walk them through over a cell phone logging on as administrator. We've not had a problem (yet) with this practice. However, we weigh each request carefully. These execs understand they run the risk that their laptops could need formatting if we determine it poses a security risk from anything they've done by having those rights.

I can identify with both sides. I am in a development shop; developing and testing new apps all the time. I have systems admin duties but no network admin rights. Our CIO does not like my division so we don't get them. Everytime I need to upgrade etc, we are told to call the help desk.

If the "helpless desk" had a clue half the time, I would not need to "borrow" admin priviledges from others to get things accomplished.

So, my answer to your discussion is... it depends on how good your services are. Sometimes, some of us do need to "control our own destiny".

louindc@yahoo.com

I wholeheartedly agree with your statement. Myself, a telecommunications engineer, do a lot of international travel in Latin America, Africa, Middle East etc. I cannot count on the IT dept of the company, located in Montreal, Quebec, Canada, to support my lap-top whenever something happens while in the field.

Best regards

Alex :-)

This kind of situations are lived as a confrontation related to who is in command.

The notebook is feeled as personal property and that is why some execs are reluctant to be commanded on it.

It is key to handle policiy distribution and communication along all users properly.

To fight this on all hierarchi levels, at the time when we deliver a notebook to a user, we make him sign a "Assingment PC Form" where it is stated that he is receiving PC Serial number #### with the following SW installed to be use as a tool to perform his work to the Company.
In this note there is a reminder of some key sentences extracted from policies, with the items that we want to leverage on based on the culture of each particular organization (i.e. user is not allowed to install software without autothorization from IS, or it is not allowed to use software without its proper license. A password change policy could fit here too, and any other we want to leverage on).
The intention is to mention as least and key reminders as possible.

Later on, during a discussion, this Note signed by the user could be invoked as an external factor, avoiding confrontation.

If the exec insist, he will know that if he scalate the problem, he will find this signed note in his path.

Nicol?s Perez de Arenaza.
nperez@iredix.com