Cool, here is a VM without domain join and no access to internal resources. Feel free to use your admin permissions on there.
Seriously though: developers need admin access during prototyping unless you are a giant enterprise that already has CI\CD, dependency management, staging environment etc all set up and properly configured. For everything else, devs should have their contained sandboxes with admin permissions
The holy war between good (IT) and evil (npm) but my feature needs to be out end of month and I can’t have everything installed immediately blocked or I won’t meet the deadline
Y’all joke, but when that ‘task’ is run through process monitor, we see it’s trying to overwrite a DLL in system32, create a directory at root of %systemdrive% or cache some data in the Program Files application itself, instead of utilizing ProgramData or Appdata properly.
When applications fail these simple practices and demand local admin, they shouldn’t touch your network.
<3
As an insane person who moved all my folders to the D drive, it’s absurd how many big companies hard code C:\Users\you\AppData\Roaming
I’ve worked for two organisations that distributed licences for users. Being able to prove, under scrutinisation, that your general requests do not need to be questioned for that level. Anything above your level of liberty in the data governance would be checked—though 99% of the time you already know this and explain in full detail on the request to help.
It worked perfectly and I don’t know why it’s still not the norm.
In a ‘wet cement’ org structure, often the specialists in an area know far more about what’s going on than the juniors gatekeeping. If you aren’t buddies with the person on top, you join the queue and a 5 min job becomes 6 months and several meetings; if you don’t already botch a dodgy workaround before then.
Edit: I’m in year 3 of getting the Oracle SQL add-on allowed to direct query, read only, in Excel. My current workaround is to use the IDE to export to CSV, store on SP, then PQ that… And, yeah, I have write access in the IDE even though I keep telling them that’s bad… Apparently, that solution is more secure. I’ve spoken to the CIO about the concerns and how it breaks the fundamentals of our data governance framework. The new infrastructure architecture gets it, but has to spin the better way of doing things as a “trial” which has taken 6 months to approve and counting…
LUA Buglight is also good for documenting why a program needs admin when it shouldn’t.
After that, you just write an admin shim with the app compatibility toolkit and just add write perms to the necessary folders.
…Unless it’s system32. Then your software request can die in a fire, and I’m forwarding the info to your boss (and mine) before you can complain to them.Too much jargon. Employee is just using an AI agent.
Sorry, gonna need a ticket to escalate that
IT tried to get super strict with that at my company, but they relented when ticket volumes went up by a couple thousand percent.
We have done this, and it took years.
We audited every exe and whitelisted like majority with over 50 users. Some occasional victims here and there (I lost access to my self compiled ones, too) but overall no THAT signigicant rise in ticketing
I do industrial controls. The software we are forced to use is usually proprietary, sometimes old, and always very poorly written. Plus there’s the networking issues. A huge amount of stuff is just statically addressed, so I might be switching the ethernet port on my laptop from an 89.89.x.y subnet, to a 10.10.i.j subnet, to a 192.168.a.b subnet, and back again multiple times a day. When IT first took admin rights off our laptops, it took away our ability to change IP addresses. There may have been some small amount of malicious compliance.
