admin rights for executives?

The way we handled execs was to provide them with their own polished support team. Most execs don't know their modem from a hole in the ground, so they appreciate having a well-dressed individual come and rescue them.

For those that have enough knowledge to make them dangerous, the same team can explain to them why the rules are there, etc. But you must have backing from on high or the execs will make life difficult. Most can at least understand that if they screw up their work PC, their work will suffer. Show them the danger versus benefit. Insist that if they want customization, that it should be done by them on their home PC (that is not attached to your network) or that you can provide installation of certain programs once they have been determined not to conflict with company work programs. It will come down to a power play - beware of the walls that will result as you can find yourself unemployed before you know it.

Lastly, image his PC in a working mode so that it can be restored quickly after he screws it up, because he will screw it up. And for kicks keep track of how many times this takes place and the cost involved.

You have to consider the totality of your career, not just your primary responsibilities of providing network support. In general the wisest thing to do is to completely defer to an executive if all he's doing is causing a little trouble, not breaking the law.

You'll be able to fix the little problems he causes. If you tick off the wrong person and get fired, you will have a big problem, and those are harder to fix.

You as well as I know there is no such thing as an exec that should have any Admin rights.

They're dumber than a post when it comes to doing anything on a computer, let alone trying to just turn one on.

You give that person rights and they'll hose the machine and cause your department to spend unnecessary time fixing a problemt that didn't need to happen in the first place. And the exec won't care, and will more than likely do it again.

That's my experience, and I'm stickin to it.

Mrafrohead

I have experienced this in a number of different work environments, both private enterprise and govt beaurocracy.

The first thing is I point out what the policy is and that I do not have any authority to overide or change the policy if I wish to stay employed, then point them to the person who authorised the policy. Funny how the execs don't want to waste their boss' time with minor things like this.

I have seen organisations that have a set format for all their machines, those wanting to personalise them can have all the admin rights they want and get personally billed for any service calls on the machine as the support people are only there to support the standard set up.

I have also seen organisations that resolved this by having the set format installed on the network controller and whenever a machine logs on to the network the server checks certain files and then updates and program updates/upgrades needed and restores the system to the current format, and every machine is shutdown over the weekend. Most people who want to personalise either get used to doing a regular resetup or give up on it.

Others have no solid policy and allow this do an image everytime they update or upgrade the system. When there get a call and it is not an easy fix they just reimage the machine. We got the image discs to such a point that we trained some 'regular' exec clients in putting the image disk in and doing it themselves, made two disk for these guys. This saved us many hours work as they would reimage whilst out to a meeting or lunch.

Just make sure its considered a company policy not to have admin rights. You might want to hold a lunch-and-learn about 'User Policies on the Network'. If he's giving you a really hard time give him local admin rights, then just tell him that if something goes wrong with his pc then you'll need to revoke his rights as an administrator on that pc. You don't want to have to keep fixing a pc due to user errors. Tell him that time is money and I'm sure he'll agree. If you do give him local admin rights, he may not be as tech-savy as he appears to be. If he's not technical, then it will be a novelty for a few weeks then he'll forget about it. If its for simple tasks like changing wallpaper/fonts etc then its not worth making an issue of it, just give it to him.
These are my personal opinions and ideas on how to manage that type of a situation.
Good Luck

Run into this situation myself, exec's are not above company rules.

Make him understand and get him to sign a non-disclosure/disclaimer form, making him fully aware that any problems or damage caused from him having admin rights, HE FIXES.

He wants admin rights, he can have the responsibilities that go with it.

You specifically said "executive" which implies his right to set company policy - IT techs do not really have this level authority so be careful; this could quickly become a ride you will wish to get off.

The problem you are facing has two facets - technical and political.

Politically, I would find the executive who currently "owns" the policy and ask for their ruling on the poicy amendment. If the result is an amended policy that allows the executive administrative rights, go ahead and give them. If not, the problem is resolved without you being the bad guy.

Technically, if you want to be a top notch tech, you'll also set up some method to rapidly restore the system in the event of a screw-up. Alternatively, if you are one who wants to believe that "IT rules", you'll impatiently await the day that you can take about a week to rebuild the laptop as punishment for the exec's insubordination towards IT's overarching authority.

First, make sure it's not just IT policy, but that the CEO (aka president) has signed off on it. Get it signed off if it isn't already. Then he'd have to justify changing the policy company-wide.
Second, if it's not 'company-policy' he'll probably get it. Be prepared to document every minute you spend supporting his laptop, and the associated costs. $ talks when you build the case to remove the priv.
Third, look into conducting 'configuration reviews'. It's a good excuse to see what's been installed, keep it updated and within spec, and remove what's not allowed.
Remember, document everything regarding this 'exec priv' and eventually you'll have a case to remove the priv, assuming he abuses it.

Regardless of this person's history, he is now a Sr. VP in the
company. As with all employees, he must follow the
policies. So, if the policy is clear that admin is solely the
domain of IT, then he cannot be given admin privileges by
you, since that would make you in violation of the policy. If
there is room for exceptions to the IT only condition, then
give him privileges. This is because exceptions become the
rule across time.

If the situation is the former, tell him that since his
previous tenure with the company, policy and policy
enforcement has changed. Should he feel it is better for the
company that individuals have admin privileges then he
should submit same to the policy people (varies by
company) for their next review.

If the latter, then you bring the non-exception position to
the policy people for their approval by using the exceptions
as examples of wasted IT resources (fixing individual's
mistakes, re-securing systems and reducing company risks
of liabilities from misuse) and inefficiency of user time.

Note that the decision to make the policy exclusive or non-
exclusive is conditional on the approval of people outside
IT. Keep this group aware of the risks of variations to
policy, while you at all times follow policy as written and
intended.

If this executive isn't part of IT services, how could he fire you? You don't report to him, he's not in your department. Executives don't have as much power these days as what they did a few years ago. If the exec was in the IT department as your own manager or something he'd have admin rights anyway since he'd have to approve whatever went on with the network.

We run a standard SOE for the entire company. Executives receive the same rights as basic users with slight adjustments made in AD for access to reports and so on. All these adjustments are approved up the chain of IT services so regardless of what an executive thinks of you for saying no to granting him admin priviledges they can't really take it out on you since it's the same scenario for everyone in the company.

There will always be the exec who thinks he knows more
than he or she really does. There will be the prima donnas
who demand a different brand of machine or software that
will require extra support. There are those who will want
you to support home systems.

You have to build this into your plan. Because no matter
how important the CIO is - the CFO or COO will overrule to
keep peace. The smaller the business the worse the
problem.

In a similar case, what I do, is to get toknow the exec better, and ask him to mentor me in this specific case. I usually ask him what should I do, and how should I reply to him, especially in front of HIS peers. How should I justify letting him get Full Admin Priviledges and refuse it to his peers. He knows best and you work FOR him.

Of course, him beeing the mentor, he can have anything he needs to have, and you are here to serve him. How many times he screws-up is irrelevant: you work FOR him, and before you know it you will be working WITH him and there is nothing better than forging a good relationship with any co-worker be it a CEO or a janitor.

The rule always applies: Please help me and teach me and mentor me.

If - by miracle - you fall on a "one-of-a-kind" rotten apple, then at least you have it documented that you did your best and you let him hang himself by putting it in writing that you do not suggest (and the word here is suggest) that he get an admin access, and that he is being an exception to the rule, and that he is then responsible for any delays he might create with his laptop.

REMEMBER that this does NOT mean he will have any priviledged access on the network !!

Create a win-win situation.

I've read through all the replies to your question and have dealt with this myself. Here is what I have to say.

Take a small piece from what everyone had to say. Here is what I do.

First of all, the law is the law, breaking the law has to be clearly defined in your IT policy.

Is your company a public company or is it privately owned? This makes a huge difference in regulatory compliance which may govern what privileges he is allowed to have.

Become his executive support and keep up to date ghost images, this will only help you in the end.

Most importantly, and most here have stated it, document everything, cross your T's and dot your i's. Make this part of your status report that you submit to your supervisor.

Deffer responsibility, you didn't create the policy and you are not high enough to customize it per user. No need to back down on what you told him. Simply explain you are willing to work with him in trying to get what he needs. (be political) But that you can not allow this without higher approval. The deffer to your supervisor and get it in writing (either by creating a special privleges form or getting your supervisor to sign off on the work order)

The name of the game is to keep the execs happy no matter what, at the same time you need to keep your systems safe so when ever there is a change in order, make sure it is documented thoroughly and signed off on by those who have the authority to change the rules.

Use your own tools against him, we use spyware detection and blockers as well as scanning systems on a weekly basis for unauthorized applications. Just because he gets local admin rights doesn't mean he can install anything he wants. I would not even cover this as part of the admin rights issue. Your IT policy should clearly outline this seperately and it should be treated as a seperate issue. When and if spyware or any other unauthorized software is discovered, you can address that. First by notifying the end user (yes SVP or not, he's still just an end user) via email of the discovery and that the software will need to be removed, CC: your supervisor, then open a work order and schedule the removal.

Summary - Do what ever you can to give them what they want. Don't tell them it can't be done, tell them how it can be done. Document everthing and get signatures where needed. Enforce policy and keep your supervisor(s) in the loop. If the poop is gonna fly, remember to duck.

That's the best advise I can offer.

Give him admin rights on his laptop, but, as suggested elsewhere, warn him that the turn-around time for any major fixes (reimages, etc.) is 24 hours. After a couple of long waits without a laptop, he will probably get the idea, particularly

Another option to consider is making the user part of the Windows Power Users group? We have several non-Microsoft applications here that, according to the manufacturer, require the user have admin privileges to run; we tried "Run As" from the Users group, but it just didn't work. Power User status appeases these apps without allowing the user too many excess privileges.

We had a simmilary problem with an exec. Although he did not want to comply with the normal internal policy. We have a very tough CIO and total buy in from our shareholders and board members. We raised the issue with the Shareholders and they took up the issue at their next board meeting. We held our stance on the company policy. We also have two dedicated technical resources for our exes.
The Exec finally agreed that altough he was on the top of the company food chain, policies and procedures are a necessary and integral part of the company, and no excpetions could be made. problem solved.
This would not have been possible, if we did not have our shareholders and board member buy in right from the word go.

I agree 100%, they are the ones trying to run the business, not us in the trenches.

if they want it, give it up, document it, if you have issues, notify your manager in writing and move on. once this is accomplished, it's no longer your responsibility. You have done your job, that's what you get paid to do.

It has taken me a long time to learn this.

We have a fairly laid back policy regarding user rights on local computers/desktops. It works because it's a small network though, only about 50 users. The rule, in writing is, you are allowed to administer your own desktop, HOWEVER, we do not support, fix, repair or otherwise take care of problems that have to do with anything they install or arise from anything they install. We also disclaim, from the point that they change something, any responsibility for anything on the computer.

What I have found is one "Hrmmm, I'm going to have to reformat this, will be a couple of days before you get it back" has pretty much stopped people from playing too much with their computers.

What -I- would do?
a) Give the guy what he wants.
b) Get his acknowledgement that he understands what he is playing with and the consequences. (I'd suggest getting it in writing)
c) Make sure that his superiors understand that you are giving him admin rights because he demanded them but you can't be responsible for what might happen, i.e. losing usage for a few days.

What's this chap's history? Did he previously have the rights? And, if so, were there issues? If so, you have your argument to deny his request. If he cannot come up with a sound business reason for same, then no.
Also, figures around down time, recovery etc would be usefulto support your case as revenue is king.
Good luck

Every new employee and all of the old ones have been given the company policies and expectations of behavior. They have to sign a form agreeing to those policies before their network access is enabled.

A) all machines have 'Local administrators' and most of the users know their password. These accounts can NOT attach to the network. The network account is a 'power user' level and the login procedure / group policy verifies that setting before allowing network access.

B) I log any changes to the standard setup on systems. I also retain signed notes for any variances to the 'standard' setup.

C) I have converted half our systems to XP Pro because of the 'System Restore' function this not only enables fast recovery, but DOCUMENTS changes and when they were made. ( we sill convert the rest of the systems this fiscal year. If you wish to stay with 2000, keep a 'ghost' of the drive as delivered and try Win Rescue. It works like 'system restore'.

D) If at all possible, avoid the fight. Document the variances and stay current with your logs.

Like all executives they are allowed to make their decisions, and live with the results. Let them! They will find out soon enough that they cannot afford the outages and loss results of their action. Or, perhaps in this case, they will be allowed a repeat performance of their lay off of two years ago. (You can only hope!)

Another issue is of IT policies as opposed to a definitive "Security Policy", as in ISO 17799, that is driven from executive sponsorship,and risk assessment of the legal liabilities. The questions of wayward executives is answered and easily controlled.

Robert Elm
[HEGL International]
P.O.Box 318,
Hamel, MN 55340
612-308-3002
relm@usinternet.com

ISO 17799 Information Security Management Systems
(BSI Qualified Implementation Management & Auditor)
WWW.heglintl.com

Allowing someone to dictate change without a business need is opening Pandora's box.

I can assume that you do because you probably wouldn?t be having this discussion if he was VP for another department.

Education is the most important tool you have in your arsenal. Teach him the reasons that Administration privileges are limited. Administration privilege makes the machine more open to Virus attacks, Spyware and other unwanted menaces. Thus making the network more vulnerable

If he still insists on the change then have him make the change request based business need. This is an explanation of why it is a requirement and have it signed off by a superior. (superior to the person making the request.) I know in this situation that is very limited but that is the policy that we have here. If it is the president that is making the request I have my superior sign off.

You can request this because you are going outside company policy and you need to document any deviation from company policy for future reference.

If the business reason is not a need it is a want then you have something to work with.

At the company I work for, we run W2K on the backend servers and XP Pro on the workstations, including the laptops. For all workstations, the profile for the users is set so that they have local administrator access. This doesn't give them squat on the servers, but gives them a lot of control on the workstation.

Here's the catch:
We have group policies, that's real Windows Policies not a piece of paper, that enforce a great many things on all users. Basically, anything that a workstation user could use to cause a problem is locked out. The only complaints that we ever got were the users who wanted to clear their web browser history (the policies also allow our Network Operations group to monitor certain activities and provide the ability to audit any workstation at any time), and those complaints were all within the first two months of the XP rollout.

Now you may be thinking, "How do the developers get anything done???". The developers workstations are all on their own subnet, within their own domain. Yup, our own domain all to ourselves. We're allowed to do pretty much anything we want to our workstations, but when we screw up (WHAT??!!!?! Developers screw up????) we "flash" our systems back to the initial setup, or to our last good image.

When things do go amiss on the non-developer workstations, they get "flashed" back to the standard installation. The IT support staff doesn't even begin to try to troubleshoot. It's not worth the time or effort. Everyone knows, you screw it up, your box get re-flashed! The "flash" is a customized XP Pro installation that has been burned to CD, so the IT support staff shows up with one of the CD's and says "this will take about an hour, why don't you go to lunch?".

It's not all peaches and cream because IT (often) gets called on the carpet to justify why things are set the way they are. So far IT has always been able to successfully defend their position.

All in all, it works out pretty well.

Sounds like the guy may be a real jerk, but still, he is the boss above you in the company, is he not?

You do not own the system, the company does. It is your job to keep things running, regardless of the stupidity of the users. I'd give him what he wants, with the proviso that if he screws it up, he may have "some down time." Of course, if he is the company's VP, you'd have to eat those words most likely.

I work in HR, and we get the same old questions from people about insurance coverage, company policy, etc., and we don't tell them, "Hey, the policy is that you should let us determine how to select your insurance and be happy with it.----We give our customers options, and we advise them of what we think best, but they are free to screw up their coverage if they so wish. And yes, if they do, then we get to fix it for them. It's all part of providing customer service.

IT must develop a customer service attitude, or it will find itself in power struggles that it cannot win, especially with senior exeuctives. (I know, been there, done that.)

This is really a no-brainer to me. As a support person I work at the graces of the executives of my company, they are the ones that pay my salary, purchase and own the equipment that I use. It's never an IT against the executive it would be dumb to look at it in this manner. I know a lot of IT guys that think that they own the network that they manage and fight to control access and such, they tend to find themselves bested by the powers that be and giving up ultimately, of course this is after a rather large loss of face on their part. Others, don't give in and the network that they thought that they owned becomes the property of their replacement who understands that in a capitalist system that the workers do not own the means of production.
Back the data up, ghost the machine and give the guy what he wants. If he messes it up, fix it, that's your job.

If the exec is computer-literate enough, this won't work.

Try creating an "Executive Account", give it the same rights as any normal user, but the more important sounding name will make a lot of power-happy types feel like they're getting something special.

If he's educated enough to know that that's just BS, it won't work. You'll need a clarification from someone senior enough in the organization to have real policy-authority.

The top people in the place I work are the owners of the business, and if they wanted admin rights on the server, we'd give it to them. After all, they own the server, can't very well tell them no way. They're smart enough to not want that. Sounds like your guy isn't that smart.

If you do end up having to give him Admin rights, you should be able to set it up so he can only blow up his own laptop. Give him admin rights on that and regular user rights on the LAN and server - that way he can install his own spyware and trojans on his laptop, but can't put anything on the server. That's still a risk, but a lesser one than full admin rights to the whole system.

This whole discussion really heats me up. Over the past 30 years, I've been a user, and I've been the IT guy.

Reading between the lines, it seems to me like YOU are the "wanabe." You seem more miffed that someone who was laid off in the past is now back and in a position of power than anything else. I don't see how giving him admin rights to his local machine is going to hurt anyone. If he has any tech abilities whatsoever, he'll find the tools to give himself those rights anyway.

I really don't agree with the limitations that a lot of you folks want to put on users - JUST BECAUSE YOU CAN.

I really hope that someone in a real position of power finds out that the guy who punishes the exec by impounding his machine for 24 hours finds about it and cans his butt.

You guys ALL have to learn that the only REAL business of any business is to 1) sell things, 2) manfacture things, 3) provide a service - or some combination thereof. Like it or not IT is just a support mechanism to do the real business, not unlike the people providing any support services, secretaries, janitors, etc. Think about it, if the janitors started messing with the senior executives because they didn't like the way they threw the trash in their wastebasket, they would not last very long. You guys ALL better get a better attitude. Although there are still a lot of these folks that know very little about technology, there are also quite a few that are very savy - or they have friends and family members that are. If you like your job, you might want to choose your battles a little more carefully, and not try to be such and "IT Nazi." Worst they can do is screw up their own machine. Anyone of you that think there is a legitimate reason to restrict a user from choosing their own screen saver or color scheme is a little daft. If the janitor made you keep your chair or pencil holder in a certain prescribed place, you'd be a little miffed.

BTW - do YOU have rights to make changes to YOUR local machine???

-TN

However...

Make sure you develop a full project plan for how a machine like that would be implemented on the network. Include any costs required to make sure that the machine is logically separated from important data that can't be compromised. Make sure your plan includes enough time to get all of the appropriate waivers required to implement this. Also include any overhead costs for supporting this one-off machine, above normal network costs. Remember that any additional software or hardware that he puts on his machine will probably have to be vetted through normal channels. Appropriate waivers will be required for each and the software licenses will have to be included in your companies configuration management system. There will probably be other costs for special backups and restores from his machine, which should be kept separate from the production system, in case he contracts any viruses or worms.

Make sure he knows that this is required for such access and why. And make sure he knows that this item will appear in the next budget, if approved.

I worked for a government facility that required high security. One of the top heads wanted his PDA to connect to the network to download his calendar. PDA's, themselves, were usually not allowed in buildings. We came up with a solution to do that securely. I don't know if it was actually implemented, because it took long enough time to figure out that I was out of their before implementation. However, it followed policy and we went through the usual hoops to get it done. He'll have to jusify that expense to his people. Budget planning is not my job.

I have never understood not giving admin rights on a laptop computer. Without them, how is the user supposed to cope when issues arise in the field (the actual function of a mobile computer). More than once we have had users unable to work at a remote location because an issue came up on their laptop and they were unable to fix it or have it serviced because they didn't have rights to their own PC. This happened to one engineer while visiting India. He ended up wasting the better part of a week because his laptop was down. Pretty much a waste of a $7000 trip, far more than the value of the laptop that some IT guy on a power trip wanted to control.

So my advice is chill....

I completly agree. Too often we set our policies very strict to save ourselves time and billable hours, and end up having a negative impact the end users productivity. We sometimes make change requests so stringent that users will do anything in their power to get around us.

I would rather be known as a helpful problem solving team member than as an impediment to productivitiy for the sake of a IT department "Policy" that was imposed on the users.

should exec's have admin rights to their laptops or not? That is the million dollar question with no right or wrong answer. In my environment, they do have rights to their own machine. We have policies that redirect things like favorites and and my documents to a user directory on the server so if they blow up their machine, we reimage and they are automatically redirected to the servers for their data. If they avoid the redirection and loose their stuff, shame on them for breaking their machine in the first place.
Unfortunately, that is the perfect situation. Politics usually wins and we have to bend over backwords for them. We hate it, it isn't fair, but they are the ones who pay us.

If this exec is like many where I work, they tend to have highly sensitive corporate information on their laptops. The VP must understand that the policies exist to protect that asset. If he can look at information as a business asset and understand what happens when he loses or deletes something, it might make the VP realize that it is an impact to the bottomline.

Then if they continue to persist on it, have them sign a management acceptable risk form. This form identifies the problem, risk, and consequences when security is relaxed on a policy. If they sign it, they indicate they are willing to accept the potential loss to the business.
Jeff Evenson, CISM, CISSP, MCSE

Dude,
You're getting a lot of good advice here (some, maybe not so good depending on the 'culture' of your workplace). However...
You mentioned your boss, suggesting there is someone higher up the ladder than you who has a stake in the outcome of this little roundabout. I think the safest thing in situations like this is to defer to that person and let them decide how to proceed. If the existing policy is there's, they're not ganna appreciate you making an exception they are opposed to, and there is someone else, with greater authority than your self who can make the call, and therefore ultimately take the heat of any fallout (and there WILL be fallout - perhaps only an increased support workload, but fallout nonetheless).

Just me $0.02 worth. Good luck with your new headache, er, I mean VP.

In the firms I've worked for over the last 10 years, laptops were either used for (among other things) remote connectivity or attaching to the network when the user was in the office (regardless of whether he/she also had a desktop pc.

In those cases, there were 3 policies at issue, internal 'computer use' standards, network security and remote connectivity guidelines.

Have your boss simplify the issue up his chain of command, as a "bottom-line" issue, which is all it ever really is at the top of the chain: If your VP doesn't do either of the two things I mentioned, above, its a question of the cost of potential IT services (additional maintenance, reconfiguration, reinstallation, etc.) vs. the potential added value of his productivity.

If he does connect to your network with the laptop, a laptop on which he hopes to have the freedom to install anything he wants, he puts your whole network at risk from viruses, bots, etc., and you should be able to have the issue quashed from above him, based on the potential loss of business. (Standard "best practice" when a virus hits the network, is to detach everyone from it until the issue is resolved, vvirtually or potentially stopping business for a day: What's that worth to your firm).

If the VP connects remotely, the issue is whether your remote connectivity is set up securely enough to ensure - and I mean ENSURE - protection of your network. If it is, we're back to the same issue of potential IT expense vs. VP's potential productivity.

If your remote connectivity isn't fully secured - shame on you; your fault.

Take it from a Computer Operations Manager: Policy should be adhered to...but it IS a bottom line issue, no matter how much IT wants it to be finite. Its the potential cost of the risk & recovery vs. the potential gain, pure and simple.

One piece of information that is missing or I just missed it is whether the laptop is going to be attached to the network other than through a VPN or other external access (DSL, Cable). If not, give the Exec local admin rights to the laptop. Have him sign a document stating that any software added to the laptop will not be supported by the company and he will be held liable for licensing violations.

If the laptop will be attached to the network you have to stick to your policy. You can still give him local admin rights, with the condition that the laptop will be blocked from accessing the network. Reguardless of some of the other comments posted here, you have a responsibility to protect the assets of the company. If your company has an Audit Department, have your boss meet with them since they should have direct access up the food chain.

It seems to me that the VP is on a power trip from being called back to the company after being laid off two years ago.

We have the same issues at the university I work at. We have created a form that the user needs to sign. The form states that the user becomes responsible for administration of that laptop.
If the machine becomes compromised,it will be blocked from the network. IT will only offer limited software/hardware assistance in case of problems and this normally ends with rebuilding the machine and possible loss of data. The end user also becomes legally responsible for installed software and the laptop is subject to audits for unlicensed software. The bottom line is if they insist on admin rights, they are on their own. When someone with admin rights has a problem, they are always at the bottom of the queue.

If you turn this fight into you against him, then if he gets his way and doesn't screw up your IT policy looks like fluff. If you are supportive, don't take it personally, and just advice of the "potential danger" then you can't be wrong. Document everything to prove how right you are ;)

Mike

I go one step further and set up three partitions:

1.) Default 2K/XP with full local Admin rights
2.) Alternate 2K/XP with only User rights
3.) Data partition (move My Documents and email files to here)

I use System Commander to isolate and protect the boot files.

If the user screws up the default system he can reboot to the alternate and continue working until I have time to correct the problem. The only problem I've run into is training them to not store files on the desktop (but one system failure usually corrects that situation).

In my whole life I have never been able to control anyone. The closest one can come to control is to create an environment where the other person is willing to go along. When you have that issue resolved then you can work with people. Until then policies are just writing and only mean what the boss says they mean.

A little pain on the exec's part will provide a substantial lesson and you the opportunity to shine as the person who "bailed them out".

No way. This has nothing to do with rank; it is policy. Here's a couple arguments.

1) If something goes wrong, this individual is not responsible per his job description. Whomever is responsible for consequences is also responsible for policies. It would be possible for the individual to accidently load software that could affect your network, data security, other users, productivity, etc. The IT staff that has prepared to deal with those issues have a responsibility to everyone.

2) The individual wouldn't ask to have unlimited access to the checking account overruling a financial staff member would they? Why would this be any different. It is company assets.

I do agree that executives should be given preferred treatment and possibly access to additional tools and documents (especially software) in order to do their jobs. IT is a support department. The second IT hinders rather than helps the company as a whole, it has failed it's role.

I work for a large major corp who found that having users (Including execs) put in writting the business reason they feel that they should have admin rights on thier systems. This has to pass by 3 people in the "food chain" before it can be done.
As a memeber of the executive support team and at thier "beckon call" 24/7.
Reminding him that policies are for everybody including execs (they made the policy, are they above it ?) and that he may ask your head IT guy to have you give him admin rights takes you out of the loop
Your just doing your job. (good compny man following direction given)

I work at a pharmaceutical company. Over the last couple years we've been working towards being more secure, both with phisical security and network security. We're under strict guidlines by the FDA and DEA that only certain people can have access to certain areas of the facility. We moved our servers into a VERY secure room that only a small handfull of people can enter. When it came time to talk network security with the owner of our company he told me he wanted it just as strict as our facility security. He told me outright that he doesn't want to know the admin password. He doesn't even want access to the server room. Afterall, the computer with the facility security software is in that room, he wouldn't want to be accused of changing his access rights. Plus he completely understands that it doesn't take much to completely hose a computer, so why would he want full control over his computer?

I wish ALL bosses were as easy to work with as mine. I thik a lot of people's lives would be a lot easier. My boss knows where he stands, he doesn't need to go on a power trip.