Networks

Ask something
Question Locked

local admin rights

0 helpful
5 replies

by addison99 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We are running a windows server 2003 std

we have just had sage CRM installed. The company installing the software are telling me that all my XP pro workstations need local admin rights for the software to run.

My initial reaction was NO

If iam right in thinking this will then allow all my users to be able to install softweare change setting etc. Even though they wont know this has happend i do feel its not a good move

an I right in thinking this or am i just being over caucious. Will this also mean that any shared folder that have specific access rights on will also be accessable

your comments please

5 replies

by jdclyde

there are pathetic packages written to only work as Admin. set them up to run as another user for just that application.

It is the best middle ground to allow you to use the software, but still not open the desktops wide open.

by sbrown95

What jdclyde is saying is that you need to run the application and/or service(s) as another user that possesses admin rights. An end user should NEVER be granted admin rights - especially because someone is too lazy to code good software.

Another alternative is to selectively apply permissions for either the end user or "authenticated users" to the specific locations those permissions are needed. You can use ProMon to find the locations access is being denied for the restricted user and apply permissions as needed. This is a typical solution for the scenario.

Either way - by now we should not be dealing with the lack of security from poorly written apps. We need to keep barking until companies jump on the security bandwagon.

by jruby

Anyway that is what I read somewhere, MS instigated UAC so vendors could catch extreme flak for lazy coding that required Admin rights.

But on a serious note, does the application require admin rights to run or just to install? I've run into situations where we temporarily elevated a user to a member of the local administrators group long enough to install the app, then they ran the app just fine as a normal user.

It might be worth testing this technique.

Jim

/* If you think the problem is bad now, wait until I solve it! */

by triathlete1981

You only need local admin rights to install the software, not run it as a program. Isn't Sage CRM a web app?

This discussion is closed to new replies.