How do you handle administrator rights ?

[sys4dmin]

Dear all,

 

I am a system administrator trying to reduce the security risks and viruses/malware on my network . I would like to know how do you manage the administrative privileges on your computers ?

 

Actually we deploy our images with a basic setup/customization/applications and users doesn't have administrator rights on their PCs. However, sometimes there is an application which requires an update and therefore the user needs to have admin rights - at least for this single installation / update.

 

I give you an example : I deploy a computer with GoToMeeting (which is a software from Citrix for attending to meetings) and other apps, until now that's fine - the user can work normally with the apps we decided are authorized for the business. But after a while, GoToMeeting will need a new version or an update when the user try to initialize the meeting. Of course this requires an admin right to install this update - but :

 

a. I don't want to grant admin rights to my users

b. is there a way to authorize only some applications to install / update ?

 

Thank you all for your precious help !

[Ath3na]

This is when you would use a deployment tool such as Configuration Manager, Landesk or Altiris. Each of these install software using the local system account. This way you manage which updates go out to users. The users don't have to update anything.

[JTPort]

In our environment all installs are done either by an IT member, or by SCCM. the majority are SCCM but we have a few speciailist packages that we cannot install via SCCM. We have some issues with software requiring admin rights to run or upgrade, however we use a product called avecto to get around this which works as a Group Policy to grant certain exes the right to run (or in other cases block exes)

[sys4dmin]

Thank you all for your replies. Yes I've heard about Avecto, now I requested a demo for Arellia which seems to do quite the same. What is your experience with mobile users ? We have a lot of users working from locations with poor Internet connectivity or staying for a long period offline.

[JTPort]

Mobile users seem to work fine, no issues with them needing rights. Should for some extenuating circumstances need them we can grant them the 'right click tools' which allows them to install software having giving a reason for doing so. We can then monitor this.