|
Posted by Roger Abell [MVP] on April 15, 2006, 2:10 am
Please log in for more thread options I very much agree with the ending comment that people absolutely
need to let the software vendors hear about how inadequate their
software's out-of-the-box needs are.
Far too many admins have to re-invent the tweaks that the vendor
should have not made necessary - and far far too many more do
not bother seeking out those tweaks and give out admin instead.
> Absolutely concur with Roger here.
>
> Most of the time people give out local admin for some silly application
> that wasn't written properly and with a little work they could have found
> out that they simply needed to give a little more rights on a single
> registry key or a file and bitch at the vendor for the admin req.
>
>
> --
> Joe Richards Microsoft MVP Windows Server Directory Services
> Author of O'Reilly Active Directory Third Edition
> www.joeware.net
>
>
> ---O'Reilly Active Directory Third Edition now available---
>
> http://www.joeware.net/win/ad3e.htm
>
>
>
> Roger Abell [MVP] wrote:
>>> We have a lot of programs that really require power users and would like
>>> to
>>> give some users admins rights locally to their machine.
>>>
>>> I was reading and saw a recomendation of the following:
>>> Create a like a local_admin and Local_poweruser as a security group on
>>> the
>>> domain and then give these groups on the local machine.
>>>
>>> I like this idea but the problem I see if say Mike is in the local_admin
>>> group on the domain and he logs into any pc he would have local_admin on
>>> that
>>> pc. I would only want him to be local_admin on his pc.
>>>
>>> What we have right now is creating two accounts for the user 1 for
>>> domain
>>> and 1 for pc. However, i would like to avoid this.
>>>
>>> Any suggestions are greatly appreciated.
>>> Thanks in advance
>>
>> Then do not put everyone in a custom local_admin group that is
>> admin on all client systems, instead - if you really really must -
>> make the user a member on their machine only.
>>
>> That said, this is a bad idea in general, and often can be avoided
>> with some extra initial work to determine why they need to be an
>> admin and fixing it so they can do what they should without this.
>>
>> As a general rule, a person should use day-to-day the least
>> powered account that lets them do what they need to do on
>> a day-to-day basis. If a user occassionally needs to do something
>> else that requires more authority, provide them a way that does
>> not entail making their day-to-day use have far more power than
>> is needed.
>>
| 
XML Sitemap