admin rights for executives?

No matter how it turns out, GET EVERYTHING IN WRITING, with appropriate signatures. My experience is that CYA is very important, for yourself, and for possible future removal of bad apples.

Company policy should facilitate the ease of doing business, not impede it.
Our company's policy is allowing admin rights to laptop users only, because the sales and service people travel worldwide and need to load software and change settings in the field to do their jobs.

We have certain people in our organization that has Admin rights on their machines. However, it is a strictly "need to have" condition depending on their job function. We also had a whole technically inclined division that had Admin rights, and lost them due to abuse of our policies. I say figure out exactly why he wants Admin rights (software installs, Windows tweaking etc...) and decide from there.

Erving Goffman's magisterial work "Asylums" describes the consequences to the personality of being placed in the care of "keepers" in an asylum like institution - prisoner, hospital or mental patient, or, in the 21st century, Info Systems policy gaol.

Some executives may be comfortable with, that is feel no sense of dissonance between being a dependant in the context of their use of information technology and an independant and authoritative actor in the rest of their work responsibilities. But I doubt many of them will be.

It is not executives who have responsibility for providing a business case for control over the tools used in their work. Rather, it is the responsibility of information systems organizations to provide the business case for circumscribing that control, when there is one.

Efforts by IS organizations to exert such control, in the absence of having demonstrated and gained deep acceptance of its business relevance and benefits, will not contribute to the overall ability of IS to support organizational goals, nor will they increase the perceived competance or job security of IS staff.

If you have not been around that long, find someone who can bring you up to speed on the fate of the "Data Processing" staffs of the seventies and eighties who failed to respond to their organizations need for increased control over information technology by line organizations and executives. Then match that to the degree of control over those line orgs and execs being advocated by IS in your organization.

Something is missing in your policy: the provision (procedures) for distinct cases which could go against current policies. Such a clause MUST be integrated, as any policy is prone to encounter valid exceptions: NOTHING is just plain black and white, as for life itself (the only black-and-white rule of life is that either you're alive, either you're dead, the rest is about dealing with other beings)!

As such I would promote a policy that is opened for modifications from time to time, as events or structural modificatins occurs. Your policy needs to be able to survive business cycles (structural, functional, etc.), and as such to have a life cycle for itself! As such, your policy MUST provide some mean for adapting itself (and to clearly document such changes, with memos and other official forms, like an RFSC - Request for Security Change)

Just assess the IT knowlege of people asking for admin privileges over their desktop.

1. Make sure that the administrative account used on the personal PC (laptop, workbook, whatever) IS NOT the same account used to log on the corporate network (!!!).

2. If they need some learning just to make sure they don't bug their machine every week, tell them to get the knowlege first, else show them how it could not only cost the company, but also that each "PC fail" is well documented for every employee (a person asking for such admin rights will think twice about it).

If you whish to stick to your policies, just tell the guy to go fetch a computer of his own. That way, his activities with Bonzy buddy, games, Kazaa, porn stuff, etc., won't have any impact on corporate assets (including his "personal" corporate laptop/workbook).

and furthermore it is the job of IT to help him fix those problems he caused.

Just because he is a v.p. doesn't give him any rights. Policies are set to keep those individuals out that may cause damage and cost company time and money. He will have to abide by those polices whether he likes it or not. If he wants his own administrative rights, he can find a job elsewhere that will allow him to do this. Stand your ground. We do have this problem where I work at and we have to safeguard all of our administrative passwords and user rights. If you'd like, I could tell him, LOL.

I have run into this situation far too many times. I have worked my way up from tech to CIO and it seems all companies have this guy....or is it the same guy? Anyway, do you hae any policies that define supported software? If so, this would be the first road to go down. If you make sure that all of the software your policies require for your company are installed and accessable then he need not have access as an admin. Also, do you have a testing policy? I require users to submit software and appropriate software licenses to our IT department for testing (compatability) and approval before use. Can the software that the person wants to use be secured using your common methods, can it be updated using the avenues already in place, how much support will it require? Also, dont forget, giving someone Admin or Power User rights also lets back doors in your security become wide open. Having regular user rights will derail (HTML) POP UP installations from the Web, a good number of viruses will be thwarted without Admin priv's. Without writing a book I think you see the road I am going down here.
DO NOT TELL HIM NO, this will just incite a show of power, just work within the constraints of policies set up by either your corporate officers or Network Admin etcetera. Good luck!

I have run into this situation far too many times. I have worked my way up from tech to CIO and it seems all companies have this guy....or is it the same guy? Anyway, do you hae any policies that define supported software? If so, this would be the first road to go down. If you make sure that all of the software your policies require for your company are installed and accessable then he need not have access as an admin. Also, do you have a testing policy? I require users to submit software and appropriate software licenses to our IT department for testing (compatability) and approval before use. Can the software that the person wants to use be secured using your common methods, can it be updated using the avenues already in place, how much support will it require? Also, dont forget, giving someone Admin or Power User rights also lets back doors in your security become wide open. Having regular user rights will derail (HTML) POP UP installations from the Web, a good number of viruses will be thwarted without Admin priv's. Without writing a book I think you see the road I am going down here.
DO NOT TELL HIM NO, this will just incite a show of power, just work within the constraints of policies set up by either your corporate officers or Network Admin etcetera. Good luck!

A real exec knows what his time is worth and how to manage it. At about $20,000 per hour, our former exec deserved all the support we could give, that "gold" support mentioned. If he had to wait an hour to do a 5 minute test install, decisions would be sacriiced, and he might not get that included break we all need sometime.

The person with the restore instantly attitude gets the business award. You can track it, but bet the exec does too, in his terms. Our second line exec at $2,000 per hour deserved it too. They don't make money being fools.

The big guy had our best person work a week to design and install his home network and link it in. Would you really rather have a contractor patch into the home office?

It really is the company interest that has to be cared for. I'll bet the person that refuses to budge on rules also gives "gold" service, even harder, or else is on a short list.

It should not be a decision for an IT Admin to decide whether to grant or not grant admin rights to anything unless he is the one signing the paychecks. Corporate policy should dictate when and under what circumstances admin rights are necessary. If you don't have one then it would be a good idea to have one drafted up and ran by legal. This way you can focus on running the systems and networks and let the VP deal with Legal on why he needs admin rights and a change to corporate policy. R/David

If the exec wants to be an IT tech, why did he become VP? Presuming the policy came from higher up than he, refer him to the exec who established the policy.

In our shop, we started out with everyone having admin rights on their own machines (not the network). Then we got new machines and new OS versions, so our support group took away admin rights to make their life easier. Apparently it didn't.

Currently, most users (not all) have admin rights on their own machines. The understanding is that if they do anything that "breaks" the PC, the support group will drop a new image on it and that's that. If you lose files etc., too bad.
If push comes to shove over the issue, you might consider taking this approach.

Like it or not, S-Ox is becoming a mandatory part of IT policy of any public corporation, and most executives already know this. Any executive who wants to keep his/her job is not going to request access he/she shouldn't have for much longer. It will make for easier administration in the long run, but it's very difficult (politically and otherwise) to back out users' existing rights on applications, data, and hardware.

I've replied to this subject before. Policies were establshed for a reason. If a VP read the companies policy on the subject he would not put the IT dept. in this position. If he wants the policy changed let him get the ball rolling and if it ever changes, then you give the rights he's entitled to.

You must be one of those CEO's, and I must have struck a nerve... nyuck nyuck nyuck...

Just because someone makes 3X as much as me, doesn't mean they are smarter than me. I mean, think of it like this. MOST CEO's don't really make wise decisions for the business anyhow. They want to make money, so they lessen the crews pay, cheapen benefits and then get a lousy product to replace what made them famous. Which then leads them down the path to extinction.

Don't believe me? Look at Carly Fiorinsomething from HP. Crap, even McDonald's is having problems from making their stuff different than it has always been.

Dont' tell me that it was the IS guy that did that...

Lastly, who in the hell was talking about threatening. There is no threat in a simple, "NO". It's just that, NO. Nothing more, nothing less...

Just because someone is the jokester of the company, doesn't give them "special rights".

IT is a necessary service center for a company, the key word being service, instead of control

I don't thinks the users should even have access to their control panel. I can't tell you how many secretarys have released a virus by trying to download puppy-dog wallpaper.

Let's face it in the wake of Sarbanes-Oxley we no lomger have the luxury of simplifying change requests. We now have to document every change that we make and the reason for the change. And to be honest for every request that a user makes whcih it only takes them 2 minutes to complete the form I have put in 20 minutes implementing the change and another 20 minutes documenting the change and its possible effect on the overall network infrastructure. So I refuse to sit there and listen to them whine about having to take 2 minutes to fill out a form. And I also refuse to allow them to have administrative righhts on their boxes as even when they only take down their own systems I will have to spend an hour bringing them back up. That hour in my world is not a billable hour. I have a certain amount of hours each day to accomplish a great deal of work. If that work is not completed I have to connect from home on high speed connection that I pay for out of my own pocket to complete the neccessary work so that I do not become hopelessly backlogged. Computers are given to end users with more applications than the users could ever use with ideal configurations, but in the fast food mentality world everyone thinks that they should have it their way. With no regard as to the time that I have to take away from my family to make it so that they can have it their way. IT departments are stretched to the breaking point already trying to keep computers secure and updated regularly. I know that I am ranting here but I learned the hard way that unless the end user know how to restore his own computer as you will be reloading it if you give administrative authority. And trust me no matter what you say upfront you will also be reapplying their customizations and you will spend a great deal of time trying to recover what you can from their old system, and answering a million tiny little questions that they will pepper you with as they try to find the best way to improve(crash) their system. The only admins who truly just Ghost unconditionally are those who are within a year of retirement and don't care if the ax falls on their heads when their VP can't find his NASCAR bookmark in his favorites.

The Policies and Procedures are in place for a reason, there is no reason that I can see that warrants this type of access, all I can see is a lot of trouble not too far down the track.

This also leads me to ask the question why was he dismissed before?

NO WAY IS HE GETTING THAT LEVEL OF ACCESS.

I've replied to this before. Policies are there for a reason. If an Exec. wants to change the policy then that person should take the steps to do so. It's situations like this that create internal IT problems and even an Exec. shouldn't be allowed to bypass established policies. I've been in a similar situation and although it's uncomfortable, stand up and deal with it. When the dust settles you will have nothing to worry about.....

You're IT the professional, he's the whatever he is.... These kind need to put aside ego and look at what's good for the company, i.e. lower cost of owenership, stable IT systems, etc etc. If he wants to play IT guy, he can do it on his home system. We dealt with that in my former company and after the initial protests - which were put down by our president - people came around.

I used to work for a large defense contractor. The IT staff would not allow this type of thing, ever. After I transferred to the computer (laptop) and printer manufacturing division, the answer was always the same, NO. If the exec ever insisted, he was told in no uncertain terms that this computer did NOT belong to him, that it was company property and that admin rights to his desktop were "verboten" by company policy (which was true). Fortunately, we never had to deal with these "wannabes" in any large numbers, just one or two. We did have one group that we allowed to do this, but they were led by one of our former sysadmins who left and came back and had the knowledge and expertise to do the job. She took care of the entire group and we only had to supply hardware support, which took a load off of the IT staff.
That is the only condition under which such requests should be allowed, IMHO.

It is a service because it is what the boss wants.

To put it simply, as long as you are not asked to break the law, do what the boss wants. Now I'm NOT saying don't make the boss aware of the risks! By all means let the boss know the risks of their choice and document you did so. But is is not your call. That is why they get paid to be the boss, to make such choices.

That is what being the boss is all about, making the hard choices.

Admin rights for execs? NO Way hosay!
They aint got a clue.

Giving admin right to one individual will start a rush for similar rights for others in the enterprise. (put on your whiniest voice) "He's got admin rights, why don't I have them". Once started down this path, you cannot stop. It will sprial out of control and you will loose any control over your shop.

Based on you message it looks like you got fired because when the exec messed up the laptop (which was foreseeable) you were not prepared to get him back up and running immediately. You could have been the hero instead of the scapegoat. It may seem harsh but it was predictable. Any number of measures could have been taken to make the down-time minutes and IT look great. Instead all you were left with was an "I told you so" and an un-employment check.

Why in the world would you want to start a P*ssing contest between VP's!?

Usually the IT VP is NOT the alpha dog anyway and does not want this problem dropped on their doorstep by someone under them. It just makes no sense. Unless the IT dept is itching for a fight (and with the budgets and positions being cut who wants a fight), give the VP whatever he wants. Anything you do that makes you a valuable resource to the people in the positions of power is a GOOD THING. Man, why is this hard to understand.

Had a similiar case at a large international company I worked in. IT manager agreed with me -- no admin but he was a friend of the CEO!!!! Finally had to give him the rights BUT.... sign a document that he was TOTALLY responsible for the software state on the machine and his department would be paying $XXX per hour if it needed work other than software upgrades. Well -- three system rebuilds later he asked for the rights to be removed -- and the IT budget was a LOT healthier...