3 ms·

This sounds like it will result in a better environment that there is in many places. I have seen places with a strict "don't install anything policies" far to

by 1ris 10y ago

This sounds like it will result in a better environment that there is in many places. I have seen places with a strict "don't install anything policies" far to often. (I have even seen terms that techincally forbade executables in the home dir. For programmers.) Don't use anything you like. Or want. Or could use to work more productive. Use the outdated debian version of the shitty software that the benevolent admin choose for you. And good forbid you BYOD. Or want to the admin to install anything else. Fist of all, the admin knows best, second it's not in the debian repos. Given you have backups and ensure they can't fiddle with the authentication system: Go for it. It's like BYOD but with provided hardware.

hackbinary 10y ago
We give our people who have reasonable need Local Admin. Giving local admin to the non-technical staff who want to download 'free' software (not FLOSS, free as in beer) because they think (at best) that they are saving the company money, but instead infest their computer malware. Most people are totally disinterested in their computing environment, let alone managing it. We standardise on certain packages because there is utility in having common programs from support, training, and administration points of view, but ultimately if there is a good reason to get/use something else, we will do that. Furthermore, any user with a local admin access can use a Kerberos 'Golden Ticket' leverage attack to gain full domain access across the entire realm. Are you seriously telling me that you want the teller at your bank to have local admin access to his workstation? How about the person at the IRS/CRA/HMRC/<you government tax office> that you just called? Local admin has its place, and certainly the first test is that will the person endanger their system by running dubious programs. The next question is if that person does infect their system, can they clean up the mess themselves? We went from a situation where we had local admin across our estate where we had at least one virus problem a week to one where I can not remember the last time we had one. Finally, can you really trust a Windows workstation after it has had an infection?

by 1ris 10y ago

hackbinary 10y ago

We give our people who have reasonable need Local Admin. Giving local admin to the non-technical staff who want to download 'free' software (not FLOSS, free as in beer) because they think (at best) that they are saving the company money, but instead infest their computer malware. Most people are totally disinterested in their computing environment, let alone managing it. We standardise on certain packages because there is utility in having common programs from support, training, and administration points of view, but ultimately if there is a good reason to get/use something else, we will do that. Furthermore, any user with a local admin access can use a Kerberos 'Golden Ticket' leverage attack to gain full domain access across the entire realm. Are you seriously telling me that you want the teller at your bank to have local admin access to his workstation? How about the person at the IRS/CRA/HMRC/<you government tax office> that you just called? Local admin has its place, and certainly the first test is that will the person endanger their system by running dubious programs. The next question is if that person does infect their system, can they clean up the mess themselves? We went from a situation where we had local admin across our estate where we had at least one virus problem a week to one where I can not remember the last time we had one. Finally, can you really trust a Windows workstation after it has had an infection?