undefined | Better HN

0 pointsbigstrat20032y ago0 comments

Nobody does what you describe. When someone has a genuine need for local admin access, they are given two accounts - an unprivileged account to log in with, and a privileged account to enter into UAC when needed. It would indeed be an unbelievable waste of time to make your IT staff sit next to users to enter admin credentials, which is why nobody does it.

And for the record, "don't log in with a local admin account" is a very commonly recommended best practice for Windows environments. It's unusual that you've never encountered it.

0 comments

4 comments · 2 top-level

int_19h2y ago· 1 in thread

"Nobody does what you describe" is a very... broad statement. I can tell you that "all devs are local admins" is indeed a very popular policy, and has been the case everywhere I worked in the past, oh, 20 years or so - including Microsoft itself.

pjmlp2y ago

Another one is local admin account is only temporarily assigned via tickets, with tracking tools every time one needs to log in as admin.

And on UNIX, I have worked plenty of times where no one gets root on the shared development servers, other than IT folks themselves.

calamari40652y ago· 1 in thread

> Nobody does what you describe.

Counterpoint: I've never heard anyone do what you describe. Therefore no one does it, even though you've just described to me who does.

What exactly is the threat in using a local admin account? I can't think of anything you could do that wouldn't show a UAC prompt. The entire point and purpose of UAC was to prevent malicious elevation without the user's knowledge. I'm really not sure what you accomplish by adding a password to UAC prompt the user wouldn't have read either way. The end result is the same.

pjmlp2y ago

Additional work for IT when people screw up their machine.

I have worked in companies where local admin accounts would be given temporarily for like one hour, after submitting a ticket with a reason.

This was partially automated via a desktop application.

j / k navigate · click thread line to collapse

0 comments

4 comments · 2 top-level

int_19h2y ago· 1 in thread

pjmlp2y ago

Another one is local admin account is only temporarily assigned via tickets, with tracking tools every time one needs to log in as admin.

And on UNIX, I have worked plenty of times where no one gets root on the shared development servers, other than IT folks themselves.

calamari40652y ago· 1 in thread

> Nobody does what you describe.

Counterpoint: I've never heard anyone do what you describe. Therefore no one does it, even though you've just described to me who does.

pjmlp2y ago

Additional work for IT when people screw up their machine.

I have worked in companies where local admin accounts would be given temporarily for like one hour, after submitting a ticket with a reason.

This was partially automated via a desktop application.

j / k navigate · click thread line to collapse