Microsoft Employees May Lose Admin Rights

daria42 writes "As Microsoft moves its internal desktop systems to Windows Vista, the company is contemplating whether to change a long running tradition and take away admin rights from its employees in order to improve security." From the article: "'We haven't made that final determination yet. We would like to absolutely look at scenarios where we can look at elements of User Access Control -- that is the feature in Vista -- so that we can start moving in that direction ... It is a tough balance and every company has to decide what is right for them,' said Estberg. However, Estberg said that for the moment, the company will continue to leave the responsibility of installing software with its employees."

Comments

It'll turn out just fine

[PrescriptionWarning]

they'll probably just install linux instead :-O

Let's hope they do

[creepynut]

Who better to test and actually use the "User Access Control" than Microsoft's own employees?

Clearly, they weren't "trying out" the Limited User accounts when Windows XP was in its infancy. Otherwise, it might actually be useful to us today.

Eat your own dog food

[mwvdlee]

"Eat your own dog food".

If Microsoft's access rights model isn't good enough for their own purposes, it isn't good enough for the rest of the world either.

If they were truely confident that it works as they claim it does, they should have had their employees in a more secure and restricted environment years ago.

Excellent Idea

[Whatsisname]

Yes, having the employees run as 'regular' users would be a terrific idea. All the problems that limited user accounts have now would be encountered by those with the most ability to fix them.

"Unusual practice" ... wtf.

[Kadin2048]

Currently, the majority of Microsoft's employees enjoy full admin rights on their desktop PCs, which is an unusual practice in the enterprise space ...

An unusual practice? Where? Most places I know have their users running as admin, because there is still software around that won't function properly if it's not run that way.

If Microsoft forces its employees to run as non-admin users, I think it's a good thing, because maybe it will lessen the amount of crap software that's designed with the assumption that it's going to be run that way.

Unfortunately, that doesn't help the situation with the tons of legacy apps that assume this, and it only takes one important legacy app in a corporate environment to hose the entire security model of non-admin users.

Re:"Unusual practice" ... wtf.

[lgw]

I don't know of a large company that still lets most employees install software, have admin rights, or do anything like that. The desktop PC has to be locked down if you want to manage 100000 desktops on a modern IT budget.

It would be wonderful if Microsoft did this! The result would be that, at least for Microsoft software, the developers would be forced to care whether their software ran without admin rights.

Re:"Unusual practice" ... wtf.

[vought]

I don't know of a large company that still lets most employees install software, have admin rights, or do anything like that. The desktop PC has to be locked down if you want to manage 100000 desktops on a modern IT budget.

You forgot about Apple. You know - the little company that makes iPods.

Over 10,000 employees, each with admin rights. No viruses, no malware, no screwed up OS that lets any process run with global read/write priviedges...no kidding.

The only difference is that they don't run Windows on those desktops.

Re:"Unusual practice" ... wtf.

[BVis]

Among normal companies where computers and software are tools for achieving some other goal, it is extremely rare to have admin rights. I'm talking about banks, telecommunications companies, etc. For these firms you either have to use special management software to install software, or you have to request that IT come out and do it.

I disagree. I've worked at multiple (non-technocentric) Fortune 500 companies where all users have administrative rights to their computers. Why? Because they don't want to hire enough IT staff to do things properly. Users whine and generate support workload far more when they can't install their home printer, or their online poker client (or whatever they might want to put on there) than they do if you just let them do what they want. If you go so far as to tell them they're not allowed to install anything, congratulations! You've officially created a Career Limiting Event. I've worked at places where there was no Acceptable Use Policy because of the costs (both in wages and employee turnover) of enforcing one. (The turnover comes when some poor helpdesk drone doesn't realize that they're speaking to the Vice President Of Things That Begin With H On Alternate Tuesdays, reminds them that what they're doing is against the AUP, and subsequently get fired. Gotta love at-will employment; you can be fired for any reason or no reason at all.)

Think I'm exaggerating? Why do you think I don't have those jobs anymore?

Re:"Unusual practice" ... wtf.

[EvilSS]

Are they Microsoft Applications or third party apps? Everyone is quick to blame MS for this but in reality it's usually the fault of the application developers that can't follow Microsoft's guidelines for writing software. 99.9% of the time it is the result of one of the following:

1. Storing user information in HKEY_LOCAL_MACHINE instead of HKEY_CURRENT_USER (even MS is guilty of this with their TS licenses)
2. Writing files to the program directory instead of to the user profile, temp, home drive or other user writable location
3. Writing files to C:\ (this is just inexcusable and lazy)
4. Some other bonehead move by the developers (such as registering components on run instead of during the install, trying to store files in winnt, using freaking INI files!)

[insert rant about under-trained programmers and lack of proper software engineers here]

If the programmers would actually learn how Windows works most of the "x software package requires admin rights" could be avoided.

Re:"Unusual practice" ... wtf.

[arodland]

Think I'm exaggerating? Why do you think I don't have those jobs anymore?

Maybe it was because you're prone to exaggeration and it was interfering with your job performance ;)

su got you a vist from security

[DrDitto]

I used to work for a Fortune-50 company and we had Unix workstations for software development. The system was configured such that if you tried or accidently entered "su", you got a visit from security within 5-10 minutes.

It happened to me when I mistakenly typed "su" instead of "du".

Re:su got you a vist from security

[limabone]

That su*(#@&(*@&#NO CARRIER

Won't fly

[Utopia]

With a huge percentage of the people being developers, these people need full control over their system.
I don't see how they can even implement this scheme.

May be they can take the admin rights from their Managers computers.

Would this mean...

[zappepcs]

Would this mean that if they switch MS employees to Vista with only user rights, that Vista would be delayed yet another couple of years while they work out the bugs? If it doesn't work for MS employees, it can't possibly work well for anyone else. Surely, they have to make sure it works since its part of securing the system. Right?

Linux Users

[omeomi]

It's not uncommon for Linux users (even developers) to use user accounts, because it's very easy to su any administrator tasks. So, maybe Vista will fit this model better, and having developers using user accounts won't be all that ridiculous...

Give them average-sized monitors too, dammit!

[Anonymous Coward]

Hell, make them work in monitors the size the average office supplies -- 15" or 17" where I work.

I'm so damn tired of apps that open big windows needlessly in the middle of the screen (MSWord's 'find' for example) covering whatever it is you wanted to actually operate on -- because some programmer had a 29" monitor -- or two -- to work in and never thought about fitting stuff into a real user's working screen.

Open find. Drag stupid window off the text area. Find. Damn, window moved back to the middle. Lather, rinse, repeat.

Sure, the IT department could supply larger monitors. But those are commodities and they're saving their budget for bells and whistles to impress top management.

Re:Who cares?

[Eideewt]

It matters to anyone who was hoping for useful limited user accounts in Vista, because if they have to use them then there's a chance that they'll actually work.

Admin rights

[Nijika]

I've seen a lot of people comment that they work at large companies and have admin rights on their Windows boxen. I (pretty much) had the same setup at both of the larger companies I worked at where MS was enforced on the desktop (at both places I wouldn't have been able to interact with the work environment without Windows).

I suspect one of the other big reasons for this is it's cheaper to do a bare-bones re-install when the Windows box goes teets up than to have an admin action every user need that is required on a box where the user is actually treated as a user.

Imagine how many real-life admins you might need to handle the hour to hour needs of a company where access rights in Windows were restricted.

This of course applies to no company that does NOT run Windows. Almost any other company would be able to handle that easily.

Talk about hidden costs.

Re:Admin rights

[naelurec]

Your absolutely right. The *nix way:

1. User needs a particular application. Depending on company policy, the user may be able to install in their own home folder. If not, they could submit a request to suppot.

2. Support authorizes request, does a remote SSH connection to the users machine, installs the software (while the user is still working) and notifies user that the software was installed.

3. Software ties into centralized package management system so suppot can keep tabs on security notifications, updates, etc and roll it (easily) into the centralized update mechanism.

The Windows way:

1. The user needs software and does not have admin rights. The chances the user can install in their home folder is close to 0%. User requires IT to install.

2. IT receives the request and approves it. Perhaps IT gets lucky and the software is packaged as an MSI that can be installed via group policy. IT adds the install files to a network share and adjusts group policy. Tells user to restart or wait until next boot to get the update. Most likely the software cannot be installed via MSI (no auto-install MSI exists) and manual installation will happen (lets face it, creating an MSI is a PITA, especially for non-standard software).

3. IT contacts the user to tell them they will access their system remotely and to log out (no concurrent users in XP). User logs out and IT logs in remotely via RDP rendering the computer inaccessible for the user.

4. IT installs the software as administrator (via remote share). IT logs out and notifies the user the software was installed.

5. A little while later, user contacts support that the software does not run properly. Apparently the software needs to be run as admin first time to initiate some files in the program files folder. Admin repeates step 2 and 3 to finalize the software install. Unfortunately, the software refuses to run via RDP. Great. Support has to either have local user login as a temporary admin to run the software or admin has to physically access the machine.

6. Admin decides to go to the machine to step through the install. Runs the software, logs in as the user account and it still is not operational. Admin then has to pull out regmon/filemon to determine the issues (as the regular user). Once done, admin has to re-acquire admin level rights (ie runas or admin shares) to make file permission changes/registry security changes.

7. After a debugging session, the software finally works as expected for the user (hopefully). Admin then writes down all the steps required in the event of a software upgrade, future install, etc..

8. Admin decides to notify software company so hopefully next version is fixed.. software company's support is not interested and state "admin access required". Blech.

9. There is no central management of the software, so admin has to manually check for updates (along with the myraid of other software). Perhaps in the spare time, the admin writes a script to assist in the installation.

While I *will* say the _ideal_ corporate installation scenario on Windows is much better (load up MSIs and set a group policy to do auto-installs), there is WAY TOO MUCH software that simply does not fit the mold. Even software that does manage to utilize this method sometimes requires elaborate step-by-step (slipstream, etc..) to make it function right (ie MS Office 2003) in this scenario.

I'd honestly be happy with the sudo equivilent. Allow specific software to run via sudo w/o password (transparent to the user). This could solve the legacy issue while forcing future software development to test against regular user accounts.

Re:Stop perpetuating the myth ...

[hackstraw]

Here's a partial list of programs that require admin rights to run (not merely install):

Here is a more complete list: http://www.pluralsite.com/wiki/default.aspx/Keith/ HallOfShame.html

Not running as admin should have been eliminated back when multiple users were first introduced with NT.

But hey, from what I hear this new Vista OS will have new features like using config files instead of the registry, shell scripting, regular updates to keep the thing working via a paid subscription, and other nifty new things.

What's next? A web browser that is not integrated with the entire operating system?

Re:Reminds me of where I used to work

[haleyeah]

I got hired at a 'mom & pop' to be the general IT jack of all trades. They had a peer to peer network running with some wierd ip scheme some consultant setup. Of course I setup a file server as well as upgraded the PCs from win 98/95 to XP. I took away local machine admin rights. Well in a couple of days I got support calls from all the old ladies who worked there. Their webshots no longer worked plus they couldn't install those damn web games. I was able to hold out by throwing around some technobabble and scaring the boss about all those security risks on the internet. Well after a few weeks serious support calls dropped to nothing. After setting up a linux box to run mysql and developing some applications in VB to replace the myriad of excel files they use,I had run out of projects. Between boredom and the boss eyeing me everytime he passed my office, I enabled local admin rights again. Lets just say between cleaning spyware and adware I've been staying busy.

Exactly!

[Jesus_666]

That's why we have instated a super-secure system. First of all, our su doesn't sit in /bin/su. Instead the file gets copied to a random place in the file system with a random filename at random intervals. Of course this is not logged, in order to improve security. Also, the only computer where it's possible to get root access at all (we use a special version of the Linux kernel that does not allow local users to become root and immediately detects any attempt to do so on all other computers) sits in an hermetically sealed room with three redundant sets of motion detectors that can only be disabled by the CEO, the CIO and our lawyer, respectively. A fourth set of motion detectors ensures that there is never more than one person in the room. The floor of the room is made up of 2x2" tiles, most of which are pressure sensitive and are not ever to be touched. The touchable tiles are dispersed in a semi-random pattern; the administrator has to know which ones are rigged, dancing a delicate ballet while passing the fifty meters between the door and the computer. Authorization itself requires the use of a special key, a keycard, two passphrases, a fingerprint, a tongue print, a retina scan, a blood sample, a sperm sample and a spoken passphrase, which is a tonguetwister in Frisian, spoken backwards. When in root mode the administrator has to press a key at least every five seconds but not faster than twice per second.

If at any point anything unusual is detected our sensitive corporate data is automatically protected from being compromised as C4 charges in the walls and floors are detonated, immediately annihilating the entire building and everything within ten meters of it.

Some say that our approach might be a bit too proactive, but =%&/(&%/%&$/"$?=(/)&%=/%/)+NO CARRIER