Slashdot Log In
Microsoft Employees May Lose Admin Rights
Posted by
Zonk
on Tue May 23, 2006 09:43 AM
from the root-to-moot dept.
from the root-to-moot dept.
daria42 writes "As Microsoft moves its internal desktop systems to Windows Vista, the company is contemplating whether to change a long running tradition and take away admin rights from its employees in order to improve security." From the article: "'We haven't made that final determination yet. We would like to absolutely look at scenarios where we can look at elements of User Access Control -- that is the feature in Vista -- so that we can start moving in that direction ... It is a tough balance and every company has to decide what is right for them,' said Estberg. However, Estberg said that for the moment, the company will continue to leave the responsibility of installing software with its employees."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
It'll turn out just fine (Score:4, Funny)
Reminds me of where I used to work (Score:3, Interesting)
Re:Reminds me of where I used to work (Score:5, Funny)
Parent
Re:Reminds me of where I used to work (Score:3, Insightful)
You unbelievable, thieving asshole.
-jcr
Re:Actually (Score:3, Insightful)
Re:It'll turn out just fine (Score:3, Funny)
Leave Rosie outta this, nerd!
Only makes sense... (Score:3, Interesting)
From TFA: No wonder:
- and -
Mabye if M$ developers were forced to run as non-privileged users once in a while, they'd realize that there's a lot of problems with trying to get through the day on a non-admin account. With any luck, this will spur them to design a better way of handling applications that fail due to insufficient privileges, as well as get tough on application developers who sloppily code their apps to demand admin rights.
Again from TFA: I'd hardly call an environment where users have full admin rights to their systems an adequate test-bed.
Once more from TFA: Saying that Microsoft is 'not smarter than any other enterprise in terms of knowing how to address security', while technically true, is deeply misleading. Any company that purports to "eat its own dog food", but performs their testing with full admin rights to the box clearly has a dangerous lack of understanding of security...a lack that we all pay the price for every day.
"Unusual practice" ... wtf. (Score:5, Insightful)
An unusual practice? Where? Most places I know have their users running as admin, because there is still software around that won't function properly if it's not run that way.
If Microsoft forces its employees to run as non-admin users, I think it's a good thing, because maybe it will lessen the amount of crap software that's designed with the assumption that it's going to be run that way.
Unfortunately, that doesn't help the situation with the tons of legacy apps that assume this, and it only takes one important legacy app in a corporate environment to hose the entire security model of non-admin users.
Parent
Re:"Unusual practice" ... wtf. (Score:5, Insightful)
It would be wonderful if Microsoft did this! The result would be that, at least for Microsoft software, the developers would be forced to care whether their software ran without admin rights.
Parent
Re:"Unusual practice" ... wtf. (Score:3, Informative)
Re:"Unusual practice" ... wtf. (Score:5, Insightful)
1. Storing user information in HKEY_LOCAL_MACHINE instead of HKEY_CURRENT_USER (even MS is guilty of this with their TS licenses)
2. Writing files to the program directory instead of to the user profile, temp, home drive or other user writable location
3. Writing files to C:\ (this is just inexcusable and lazy)
4. Some other bonehead move by the developers (such as registering components on run instead of during the install, trying to store files in winnt, using freaking INI files!)
[insert rant about under-trained programmers and lack of proper software engineers here]
If the programmers would actually learn how Windows works most of the "x software package requires admin rights" could be avoided.
Parent
My company does. (Score:3, Interesting)
They make Slashdot every now and then too.
Re:"Unusual practice" ... wtf. (Score:5, Interesting)
You forgot about Apple. You know - the little company that makes iPods.
Over 10,000 employees, each with admin rights. No viruses, no malware, no screwed up OS that lets any process run with global read/write priviedges...no kidding.
The only difference is that they don't run Windows on those desktops.
Parent
Re:"Unusual practice" ... wtf. (Score:4, Interesting)
Well, it isn't the support costs. When I worked there, IS&T was located in (should I say?) a place where grapes grow, many miles from Cupertino - and they didn't do normal help desk work. That was for ATCs - regular Apple employees trained to do help desk-type stuff. In AppleCare, we had one for about every 30-40 people, and the arrangement worked quite well.
More interesting than anything else would be a support cost per employee breakdown between Apple and another computer company - say, Dell - excluding headcount from the support organization to normalize things a bit.
Parent
Re:"Unusual practice" ... wtf. (Score:5, Insightful)
Think I'm exaggerating? Why do you think I don't have those jobs anymore?
Parent
Re:"Unusual practice" ... wtf. (Score:5, Funny)
Maybe it was because you're prone to exaggeration and it was interfering with your job performance
Parent
Re:"Unusual practice" ... wtf. (Score:3, Insightful)
That sort of contradicts itself. Wheither MS runs as admin or not has absolutly nothing to do with third party developers requireing their software to do so?
Actually, it does. MS makes userland software as well. Major applications they develop do not run, or run properly (or at all) as a regular user. Now developers may consider making their software work for normal users, but if MS does not, why should they bother? Obviously no one is going to run as a non-admin anyway, since the built-in software doesn
Re:"Unusual practice" ... wtf. (Score:3, Insightful)
That's just on Win32. Don't even get me started about requiring
Re:Stop perpetuating the myth ... (Score:4, Insightful)
At least one application has got the idea, even if it is from the company behind the OS.
Parent
Re:Stop perpetuating the myth ... (Score:3, Informative)
Re:Stop perpetuating the myth ... (Score:3, Informative)
Re:Stop perpetuating the myth ... (Score:4, Insightful)
PowerDVD
Can't attest to any of the other examples you listed (I don't use WMP, and haven't installed any of the others), but I can attest that I use PowerDVD on my limited-priveleges account just fine, thank you.
Parent
Re:Stop perpetuating the myth ... (Score:3, Informative)
You are misinformed on most of these:
I run Kodak Share on about 40 of our Windows boxes, none of them have admin rights.
I run AutoCAD on all of our Engineer's windows boxes (about 25), only one has admin rights.
I run PowerDVD on over 1,000 windows boxes, less than 20 have admin
Re:Stop perpetuating the myth ... (Score:5, Informative)
Here is a more complete list: http://www.pluralsite.com/wiki/default.aspx/Keith
Not running as admin should have been eliminated back when multiple users were first introduced with NT.
But hey, from what I hear this new Vista OS will have new features like using config files instead of the registry, shell scripting, regular updates to keep the thing working via a paid subscription, and other nifty new things.
What's next? A web browser that is not integrated with the entire operating system?
Parent
Let's hope they do (Score:5, Interesting)
Clearly, they weren't "trying out" the Limited User accounts when Windows XP was in its infancy. Otherwise, it might actually be useful to us today.
Eat your own dog food (Score:5, Insightful)
If Microsoft's access rights model isn't good enough for their own purposes, it isn't good enough for the rest of the world either.
If they were truely confident that it works as they claim it does, they should have had their employees in a more secure and restricted environment years ago.
Re:Eat your own dog food (Score:3, Insightful)
If people suddenly switched to UNIX machines we would still have the same problem. The problem isn't that the OS has an insecure permission model (neither UNIX nor Windows NT do), but that noone wants to implement it. For the type of people who use Windows boxes, this will always be a problem. They use Windows *because* they don't want
Re:Eat your own dog food (Score:3, Insightful)
I differ, windowsupdate should not be runned in user space, at least not in a default configuation under a corporate environment. In a corporate envirnomente SUS should be used to push around patches.
what need admin privs? (Score:4, Insightful)
boxlight
Excellent Idea (Score:5, Insightful)
su got you a vist from security (Score:5, Funny)
It happened to me when I mistakenly typed "su" instead of "du".
Re:su got you a vist from security (Score:5, Funny)
Parent
Exactly! (Score:5, Funny)
If at any point anything unusual is detected our sensitive corporate data is automatically protected from being compromised as C4 charges in the walls and floors are detonated, immediately annihilating the entire building and everything within ten meters of it.
Some say that our approach might be a bit too proactive, but =%&/(&%/%&$/"$?=(/)&%=/%/)+NO CARRIER
Parent
Re:Exactly! (Score:4, Funny)
At my company, the entire system is run by a benevolent AI known only as ALICE. If you visit any porn sites, ALICE will have you run out the building. If you start going to sites you normally don't, ALICE will get suspicious and have you run out the building. If you stop going to sites you normally do, or start getting some real work done, ALICE will get suspicious and have you run out the building.
If you want software installed, you have to ask her directly for it.
However, there is only one microphone terminal to access Alice. First you have to go into the basement vault, which is locked behind two keys which are 10 feet apart and have to be turned simultaneously. Thermal scanning ensures that only one person is in the room at any given time. Once you're through the door, you'll meet an old man by the name of Razael. Trust nothing this man tells you, but gain his confidence at all costs. After the swamp of misery, you'll find the server closet hidden in a disused lavatory. It's the disused lavatory with 5' thick reinforced steel and concrete walls. That's when the trouble starts.
There you will find an a NeXT cube and a Sparc station. Be warned, these are both cooled by Nitroglycerin, a highly volitile liquid explosive. You must synchronize the "keymaster" file on these two machines within 20 seconds using nothing more than an Appletalk network. Failure to succeed in this time frame will warm the Nitroglycerin enough to trigger a reaction that, when combined with the ball bearings and shards of glass stuffed in the machine, would be most unpleasant.
The keymaster file gets you as far as the login prompt on the mainframe. But if you want to talk to Alice you need the second layer password, that of the Lowest access User, or LUser. Only Razael knows that password. Once he has input it, immediately kill him. Don't worry, we have more. No, I'm not at liberty to explain that last sentence.
Be very careful with ALICE. She gets grumpy sometimes and is known to take things the wrong way. Once you have LUser access, just plug your microphone in and carefully ask ALICE for whatever it is that you need. You did bring a serial microphone with you, didn't you?
No? Oh dear, back to square one.
Parent
Won't fly (Score:5, Insightful)
I don't see how they can even implement this scheme.
May be they can take the admin rights from their Managers computers.
Re:Won't fly (Score:3, Insightful)
You may need admin rights to test and to package, but you should not need admin rightsfor 95%+ of the development cycle.
With the current crop of vmware and CPU based virtualization the necessity of having admin rights to your machine for 99% of the development cycle is no longer there.
Re:Won't fly (Score:4, Informative)
There's two debug privileges on Windows: the "Debugger Users" group that the Microsoft Debug Manager checks before allowing you to call through it, and the SeDebug priv that allows you to attach to non-.NET processes that you don't own. See this article in MSDN [microsoft.com]:
Parent
Would this mean... (Score:5, Interesting)
If they want to installed firefox or opera... (Score:3, Interesting)
Linux Users (Score:5, Insightful)
If they don't, who can (Score:3, Interesting)
Others have given the example of XP, and so true.
If you have to manage Vista the same way you manage XP, that is one less reason to upgrade, and another reason to look at alternatives.
Look at Novell with their internal deployment of Suse. They've had to suffer for a while, but slowly they are starting to show it can be done, and have gained a bunch of knowledge doing so. Novell customers may actually believe them when they suggest they can deploy Suse for some systems instead of Windows. Who believes you can run Windows without adminstrative rights?
Give them average-sized monitors too, dammit! (Score:5, Insightful)
I'm so damn tired of apps that open big windows needlessly in the middle of the screen (MSWord's 'find' for example) covering whatever it is you wanted to actually operate on -- because some programmer had a 29" monitor -- or two -- to work in and never thought about fitting stuff into a real user's working screen.
Open find. Drag stupid window off the text area. Find. Damn, window moved back to the middle. Lather, rinse, repeat.
Sure, the IT department could supply larger monitors. But those are commodities and they're saving their budget for bells and whistles to impress top management.
Ouch (Score:3, Insightful)
The actual fact they are thinking whether to use it or not makes me fill with doubt. And I really thought they had it right this time (honestly).
oh well that needs remote admin as well (Score:4, Insightful)
But then again, it is not enought to take away the admin rights from users completely, you will need a decent way of remote administrating those damn machines.
Before people start trolling on me: yes, you can take away admin rights in 2000/XP (to a cenrtain level) and there are remote tools......
Admin rights should completely go away, the user should not have right to install, modify, not even change the screensaver dammit. And not run programs at all, only from a secure pool of programs.
That includes "i-know-it-all" managers, who tend to fsck everything up, because they know it so-well they are playing in the registry, and deleting folders/etc
Now on the remote tool: the nightmare of a a support/admin person is a multi-level building, where you keep going for all those machines, instead of ssh-ing into them and fixing/installing remotely
Not because they are easy, but they are computer people and not PR monkeys and are probably sick of interacting with all the workers of the companies, who probably do not wash their hands after peeing, and then you have to go and touch 100 keyboars in 100 rooms
Oh well
Ohh, and that's why you have to wear the suit and not cargo pants and something that actually keeps you warm in the server room, or climbing on that roof yagi in the european winter to spot the balloons 5kms away on the rooftop with the compass and the binocular, to re-align the connection
Admin rights (Score:5, Insightful)
I suspect one of the other big reasons for this is it's cheaper to do a bare-bones re-install when the Windows box goes teets up than to have an admin action every user need that is required on a box where the user is actually treated as a user.
Imagine how many real-life admins you might need to handle the hour to hour needs of a company where access rights in Windows were restricted.
This of course applies to no company that does NOT run Windows. Almost any other company would be able to handle that easily.
Talk about hidden costs.
Re:Admin rights (Score:5, Insightful)
1. User needs a particular application. Depending on company policy, the user may be able to install in their own home folder. If not, they could submit a request to suppot.
2. Support authorizes request, does a remote SSH connection to the users machine, installs the software (while the user is still working) and notifies user that the software was installed.
3. Software ties into centralized package management system so suppot can keep tabs on security notifications, updates, etc and roll it (easily) into the centralized update mechanism.
The Windows way:
1. The user needs software and does not have admin rights. The chances the user can install in their home folder is close to 0%. User requires IT to install.
2. IT receives the request and approves it. Perhaps IT gets lucky and the software is packaged as an MSI that can be installed via group policy. IT adds the install files to a network share and adjusts group policy. Tells user to restart or wait until next boot to get the update. Most likely the software cannot be installed via MSI (no auto-install MSI exists) and manual installation will happen (lets face it, creating an MSI is a PITA, especially for non-standard software).
3. IT contacts the user to tell them they will access their system remotely and to log out (no concurrent users in XP). User logs out and IT logs in remotely via RDP rendering the computer inaccessible for the user.
4. IT installs the software as administrator (via remote share). IT logs out and notifies the user the software was installed.
5. A little while later, user contacts support that the software does not run properly. Apparently the software needs to be run as admin first time to initiate some files in the program files folder. Admin repeates step 2 and 3 to finalize the software install. Unfortunately, the software refuses to run via RDP. Great. Support has to either have local user login as a temporary admin to run the software or admin has to physically access the machine.
6. Admin decides to go to the machine to step through the install. Runs the software, logs in as the user account and it still is not operational. Admin then has to pull out regmon/filemon to determine the issues (as the regular user). Once done, admin has to re-acquire admin level rights (ie runas or admin shares) to make file permission changes/registry security changes.
7. After a debugging session, the software finally works as expected for the user (hopefully). Admin then writes down all the steps required in the event of a software upgrade, future install, etc..
8. Admin decides to notify software company so hopefully next version is fixed.. software company's support is not interested and state "admin access required". Blech.
9. There is no central management of the software, so admin has to manually check for updates (along with the myraid of other software). Perhaps in the spare time, the admin writes a script to assist in the installation.
While I *will* say the _ideal_ corporate installation scenario on Windows is much better (load up MSIs and set a group policy to do auto-installs), there is WAY TOO MUCH software that simply does not fit the mold. Even software that does manage to utilize this method sometimes requires elaborate step-by-step (slipstream, etc..) to make it function right (ie MS Office 2003) in this scenario.
I'd honestly be happy with the sudo equivilent. Allow specific software to run via sudo w/o password (transparent to the user). This could solve the legacy issue while forcing future software development to test against regular user accounts.
Parent
Yep... that WILL improve security. (Score:3, Funny)
Virtual Machines to the rescue? (Score:3, Insightful)
Except for device driver development (even USB and some other stuff would work correctly in a VM), are there any disadvantages?
Are there any OS developer situations that require the performance of native access at the same time as requiring administrator privlidges?
The only arguments I can think of against this are developers that require close hardware access, but with paravirtualization solutions like Xen even thats not a big issue. Well, except on Windows, of course.
Re:Who cares? (Score:5, Insightful)
Parent
Re:Personal Compter? (Score:3, Interesting)
Of course, this was back before anyone realised total cost of ownership was far greater than the purchase price of the machine. And viruses and worms hadn't been invented, and you needed to be a guru to change the machine configuration, and they only ran a single application at one time, and we weren't connected to a vast global network filled with script kidd