Compatibility, lack of IT resources for troubleshooting issues, politics and bureaucracy all come to mind. There are business reasons to argue for giving users local administrator rights on their workstations.

It may be somewhat painful at first to take admin rights away from users, but once IT administrators have worked through the issues and users get over the shock, workstations are far less vulnerable, and user-related mishaps and security breaches happen less frequently. Shops that don't give users local admin rights on their workstations have much better security than those that do. The scan can also show the numerous configuration vulnerabilities that can put the Windows OS at risk.

A simple authenticated vulnerability scan can reveal just how many patches (both Microsoft and third-party) are missing from enterprise desktops where users have admin rights. If users have local admin rights, the risk is even greater because they can veto IT's security measures. Regular Web browsing and email phishing put Windows workstations at constant risk. Endpoints are where many of the greatest risks to enterprise security lie, and giving users control over those endpoints only opens networks to more risk. Local admin rights give the user too much power. Many users - especially the higher-ups - don't want to feel handcuffed or slighted because they don't have complete control, so admins let users be the masters of their own devices.īut in many cases, the decision about whether to allow local administrator rights or not is based on emotion rather than facts, and admins cannot let such feelings determine how they manage security. They can download any application, use any program, and even ignore or undo anything IT administrators do to their devices.

When users have local admin rights, they have the power to do almost anything they want to their workstations.

Uiflowservice