Reduce Admin Risks

 Executive Summary:

Executive Summary: You can limit risks from administrative users. There's no perfect answer, but these strategies can help: Use desktop virtualization to run an OS under an administrator account in a sandbox environment. Run Windows Vista with User Account Control (UAC) enabled. Give the user an administrator account, but use Group Policy to restrict access to selected configuration options, and run Microsoft Internet Explorer (IE) and Microsoft Office applications with a restricted access token. Re-image machines on an as-required basis.

Logging on to a computer as an administrator for everyday use is never a good idea. It won’t be long before the computer slows to a crawl, begins to exhibit strange behavior, or stops working altogether. Sound familiar? But for some users, running as an administrator is unavoidable. One common example is that of field engineers. These users can be a security risk to your entire network and often require additional support to fix problems they cause by making unwanted changes to system configurations. How can you limit the risks these users pose, reduce the amount of support they require, and provide them a stable and reliable system? There may be no perfect answer, but below is a list of possible strategies that we’ll discuss in turn:

• Use desktop virtualization to run an OS under an administrator account in a sandbox environment by using VMware products or Microsoft Virtual PC.
• Run Windows Vista with User Account Control (UAC) enabled.
• Give the user an administrator account, but use Group Policy to restrict access to selected configuration options, and run Microsoft Internet Explorer (IE) and Microsoft Office applications with a restricted access token.
• Re-image machines on an as-required basis.

Using Virtualization to Create a Sandbox Environment
Virtualization provides the user with a stable and secure host system (i.e., the OS on which VMware or another virtualization application is installed) for checking email and working with standard business applications and an OS running in a virtual machine (VM) for performing tasks that require administrator privileges. Users can work with an administrator account on the VM, make as many changes to the system as they need to, and when everything is completed, roll the system back to a known state. . . .