Networks

Ask something
Discussion Locked

Network management where users have local admin rights

0 helpful
8 replies

by pkar

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I've been asked to take management of a network on which users have to have admin rights to their computers.
It's a mixed Windows and OS X client environment with Linux server (users are not given admin rights to the server).
Due to a nature of their business, users need to have local admin rights to install and test software (this may happen dozens times a day, apparently).

I'm managing the network remotely.

As the users will have local admin rights I need to have strong IT policies, where I'll specify DON'Ts for the users.
So far I see:
1. no OS updates (inc. patches)
2. no changes to network configuration
3. no password changes on admin account
4. no removal or modifications to the remote access software
5. no installations of firewall or antivirus software
6. no changes to the current configuration of firewall or antivirus software
7. no installation of software downloaded from torrents

I'd like to hear from someone who is managing or have managed network with simillar requirements and could give some points what to look at to get it done.
Of course, any other comments are most welcomed as well.

Thanks
Pawel

8 replies

by the 'g-man.'

Virtual Machines on their (now) locked down desktops. They can have full control of the VM and even roll it back to a defined point for the next test install.

A winner for both IT and the User!

Check our VMWare!

by pkar

That would be ideal option, unfortunately there is no vm soft that would run OS X as a client OS (at least not official).

by michael kassner

In cases like this I usually recommend an asset management application after a thorough inventory of all devices on the network. It would allow you to know instantaneously if anything has changed. There are many available, but one that I use often is called Qualiparc.

by pkar

Good point here.

I'm thinking about that, at least so I can prove that user has done something he shouldn't.
Still, I need to have my DOs/DON'Ts list as perfect as possible.

by pkar

I know that it's legal now to run OS server with Vmware on Apple hardware, just not sure if I can do the same with workstation(http://blogs.vmware.com/vmtn/2008/01/virtual-leopa-1.html) .
Strengely enough, both Apple sales and support couldn't give me 100% sure answer. The support says they won't be able to support it (not a problem here, I don't need it), but both says "we think it should be legal" - the word 'should' is not enough here for me, I cannot put my client in licensing issue situation.
I'm still waiting for Wmware people to respond...

by the 'g-man.'

if Apple can't tell you then I doubt VMware could (but you never know). I guess if you had a licence per VM then what real issue could they have. Even more considering the allow MS VM's on OSX.

A letter stating so from Apple should cover it - if you could get one!

by pkar

Just got the answer from Apple, after going through 6 people..
OS X Leopard EULA doesn't allow it, running on vmware is only valid for Leopard server.

no luck here then :(

This discussion is closed to new replies.