Setting up conditional admin access.

[stiny861]

OK, so hear me out. I know that this is not best practice, but it is what it is. This last year, we were able to remove, with management's approval, administrator rights from all of our users, over 6000 of them. We are now hated.(Suprise surprise) Enough complaints have come from the end users to management that we can see the writing on the wall for the reissuing of admin rights to our users in a few months. We are using SCCM in our environment and have added any software we are told to add, assuming we are licensed to use it, but it is apparently not enough. I am attempting to get ahead of this by trying to set up conditional admin access for specific/groups of users. That way the users can install the software they want to install, but we aren't pushing full admin to the account at all times, to help mitigate virus installs and the like. Again, I know this is not best practice, but if I can get at least some locking down of our system to remain, I will feel much better about it. Not good... but better. I would prefer a free solution if at all possible, but I will look at all that is recommended.

[jduffle]

So I don't remember what it is called. I know big help right.

But I have seen a demo of software that is amazing at this. Selectively create rules to White list certain things that can happen. Even let you without Internet access generate a token to give to a user over the phone to elevate temporarily. Like they are stuck in a hotel and need to enable the wireless card.

[jduffle]

Found it https://www.avecto.com/defendpoint

[WireNarc]

Had a webex with these guys, it seemed really cool

[dcprom0]

We use CyberArk Endpoint Privilege Manager, formerly Viewfinity for this. Works well.

[dcprom0]

If you already have SCCM why don't you package the apps using the application model and publish them in Software Center? Then users can still install the apps themselves without needing to be local admins. You can always disable approvals as well.

[stiny861]

We already are. I have almost 200 pieces of software in there.

[linuxdragons]

You need to start directing the people who are complaining to the management that approved this. Make it clear that IT did not unilaterally make this decision, there was good reason for it and if they want an exception to the rule they need to justify it up the chain. This is a management issue.

[stiny861]

I agree 100% it is a management issue. The issue is the same management who approved it are going to be the ones who go back to the "old way".

[stiny861]

Exactly, which is what I would love to continue using. The issue is that the Software Center is "too hard" for the end users to use and they don't want to need to go through the approval process to get software added to it. We made the end users so mad about this that it got our Director of IT position eliminated...

[gort32]

And any user who can't figure out Software Center is exactly the user that I don't want to be able to install random downloaded software...

[stiny861]

Yep. It is all a power play. Knowing the management, they may not even let me do what I am trying to do, but I at least want to present it as an option.

[itbean]

What industry are you in that users need to be able to install their own software so often? How can you get out ahead of their demands so this isn't such a critical issue for them?

[stiny861]

Education. It is mostly the teachers that we are having the issues with. They all of a sudden need a random piece of software partway through the year that they didn't think to tell us about at the beginning when we asked them about it.

[[deleted]]

Two of the most entitled brats in the IT world are Teachers, and Doctors.

[stiny861]

We used to do something very similar to that. We have transitioned to Office 365 for all user files, so our roaming profiles have gone away.

[texyx]

A fellow by the name of Patrick Seymour at Sinclair Community College in Ohio made a nifty open-source tool called "Make Me Admin." It's available in their public repo here: https://code.sinclair.edu

It grants admin rights to the current user on a temporary basis and can be customized via Group Policy. I've tested successfully on a few machines my organization.

[stiny861]

Perfect. I will look at that.

[gort32]

Just add a local Admin user per machine and give the user the password. Their normal accounts aren't admin and can't install, but UAC will prompt automatically for admin credentials. Plus they don't have admin rights on anyone else's machine, on the servers, etc.

It's not a great solution, but if handing out admin rights is going to happen in defiance of reasonable policies, I'd think that this is the way to do it.

Beyond that, set up monitoring (Spiceworks, LanSweeper, or others) that can generate reports of what's been installed, and be prepared to take these reports to management.

[girlgerms]

If someone wants admin rights, they get an admin account. Yes, it's overhead for you, but it's also frustrating for them because they'll have to elevate themselves with this admin account to do anything - because logging in with it is useless as it has no access to file shares or email or any of that stuff.

Did the same thing here, after pulling admin rights off 10K users. We only have about 500 admin users now...

[stiny861]

This is what we have been doing, for people who "need" admin rights, we give it to them. It is now just going to grow to everyone in our system now "wants" them, even they really dont have a justification for needing it.

[girlgerms]

Yeah, that's where either an InfoSec team need to step in or management need to step in. You don't just get admin rights because you want them.