> Not really. There's quite a lot you can do as a non-admin user too you know. Yeah, of course. Otherwise ransomware would be much less prevalent than it is to

> Not really. There's quite a lot you can do as a non-admin user too you know. Yeah, of course. Otherwise ransomware would be much less prevalent than it is today. That said, there's quite a bit an admin user can do that a normal one cannot. I suppose we just disagree on how important the distinction is. > Local admin gives you a few more options, but the difference isn't really worth special attention in my book. And that's fine, but surely you can see why plenty of organizations feel that it is, right? > Because you're also causing a lot of friction for the users...Every barrier you put between them and their work is a cost, and my argument is that the cost of locking everyone out of local admin pretty much always outweighs the benefits. Well I can only speak to my experiences, but given the technical knowledge of 90% users on systems I support...it is definitely worth the cost. > It isn't, it's justification for disregarding "could disable the virus scanner" as a valid reason for denying local admin to the user. Touché. That said, in environments with antivirus requirements, for whatever reason, a user being able to remove such a program is a problem. > "Good security practice" is often, in my experience, either a lot of academic crap that completely ignores the concept of risk analysis, or what someone who's trying to sell you something recommends. The same could be said RE: antivirus. In many situations, protecting a user from running dangerous applications (e.g. a trojan delivered by a social engineering attack) is likely more important than a hypothetical escalation of privilege by a user who calls helpdesk every time their password expires. > Depending on your environment, that level of cost may be worth it, but I think that's true for a much smaller segment than a lot of people who argue the point. I suspect this is because my paycheck depends on keeping the business running smoothly, not selling security consulting services. Hey, it sounds like we're in the same business! :) I agree, different environments = different requirements. But that doesn't make for good headlines, either.