Had a customer inquiry on what my recommendation was for Windows administrative rights on desktops.
My recommendation, and Microsoft’s recommendation is for enterprises to set up managed Windows workstations (i.e. organization-owned and controlled) in the “standard user” configuration.
The pre-requisite for this policy is an IT support infrastructure capable of pushing software and/or configuration changes out to client workstations, either through a tool such as Symantec/Altiris or Microsoft System Management Center, or through remote installations by IT staff depending on the situation and the number of users requiring the changes.
Standard user configuration may need to be tweaked for different types of users, for example, mobile users requiring wireless access or the ability to change time zones. Vista and Windows 7 offer more flexibility than XP; often with XP it has been necessary for administrators to unduly weaken the standard user configuration for “power users.”
There are a few cases where exceptions generally must be made:
1)
Client-side application developers or testers that need to frequently
adjust operating system settings, and install/reinstall software
2)
Knowledge workers or market researchers that can justify a legitimate
business need to frequently need to install/reinstall software
3) Users that do not have access to IT support infrastructure
If the IT support infrastructure is lacking or the policy is not strongly enforced, categories (2) and (3) can grow fairly large.
All that said, it may be that the locked down desktop will fall into the minority of what enterprises have to deal with as trends such as telecommuting, partnering, outsourcing, crowdsourcing, and consumerization gather force.
In the coming months, I'll be researching a topic along the lines of "Endpoint Virtualization to the Rescue: Protecting Against Unmanaged Desktops and Mitigating Information Sprawl."
Comments