Local admin rights leave a sour taste in one\u2019s mouth.<\/p>\n\n\n\n
They give your end users complete flexibility over their machines, which may sound like a good idea: it means your users can do things like download and run programs, install drivers and manage their account settings, all without needing to ask for assistance from an IT admin.<\/p>\n\n\n\n
But \u2018complete flexibility\u2019 translates into \u2018too much power\u2019.<\/p>\n\n\n\n
With local admin rights, your users have the power to:<\/p>\n\n\n\n
It is the end user who often paves the way for attackers and malware within the network \u2013 and it\u2019s usually because they have local admin permissions on their computers.<\/p>\n\n\n\n
The more end users you have with local admin rights, the larger your attack surface.<\/p>\n\n\n\n
To decrease the size of your attack surface, you need to decrease the number of users with local administrator rights in your network.<\/p>\n\n\n\n
Using a Privileged Access Management<\/strong> (PAM<\/strong>) tool is the ideal way to do this.<\/p>\n\n\n\n PAM<\/strong> manages user access by incorporating the Principle of Least Privilege<\/strong> (POLP<\/strong>) and Just-In-Time<\/strong> Elevation (H), meaning users have only bare minimum privileges required to successfully do their jobs, and privileges are only elevated when and where the situation deems it absolutely necessary.<\/p>\n\n\n\n So if we all agree that revoking local admin rights is necessary and should have been done from day one, why then, do most organisations still have the majority of their end users as local admins?<\/p>\n\n\n\n Because the task of revoking admin rights is a rather large, daunting and difficult one \u2013 and most PAM<\/strong> tools don\u2019t offer many solutions to make this task much easier.<\/p>\n\n\n\n However, Admin By Request is a PAM<\/strong> solution that takes all of the problems involved with removing local administrator privileges from your end users, and solves them.<\/p>\n\n\n\n Here is a list of the major concerns you may have with revoking end user privileges, and how Admin By Request can help:<\/p>\n\n\n\n 1. Loss of productivity for your end users<\/strong><\/p>\n\n\n\n Your end users argue that they cannot be efficient and productive without local admin rights. If they can\u2019t install and run programs when they need to, how will they get their jobs done?<\/p>\n\n\n\n Admin By Request revokes admin rights so smoothly that your end users will barely notice the change. The power is still in your user\u2019s hands: with Admin By Request\u2019s Run as Administrator method, users can request to use an application with elevated privileges. With the Elevated Session option, users can request a timed session during which they can operate with admin privileges for a certain amount of time. All of these requests are made from the end users device: from the comfort of their office chair. With Admin By Request\u2019s whitelisting option, applications recognised as \u2018safe\u2019 are marked as such, and users are free to use them as they please without making a request at all.<\/p>\n\n\n\n 2. Re-education and extra training required<\/strong><\/p>\n\n\n\n Changing how the end user works often results in a need for re-education and extra training for your end users, taking up resources and valuable productivity time. However, re-education and training is only necessary when there is change in how the end user needs to operate.<\/p>\n\n\n\n With Admin By Request, the user continues to work the same way they always have, often simply adding the simple step of requesting to Run as Administrator or have an Elevated Session where necessary. This means no re-education or training is needed and the average end user workday continues as normal.<\/p>\n\n\n\n 3. More resources required<\/strong><\/p>\n\n\n\n Revoking local admin rights usually means your IT department will have to pick up the slack. This is likely to result in a need for more resources in IT to manage the extra work IT admins will need to do once the end user loses their local admin rights and can\u2019t do certain things by themselves that they could before.<\/p>\n\n\n\n With Admin By Request\u2019s elevation methods, your IT admins simply need to approve end user requests for elevated privileges as they come in; or not:<\/p>\n\n\n\n The Require approval option in Admin By Request\u2019s user portal settings can be set to \u2018on\u2019 or \u2018off\u2019.<\/p>\n\n\n\n This means your IT admins don\u2019t have to approve requests in order for the user to do what they need to do \u2013 and your users don\u2019t have to wait for approval from IT admins. Win-win!<\/p>\n\n\n\n 4. More support required<\/strong><\/p>\n\n\n\n Similarly, changes in how the end user operates calls for extra support from support personnel, so you would expect an increase in support demand after local admin rights are revoked \u2013 most likely with no extra resources available for the Help Desk to cope with this increased demand.<\/p>\n\n\n\n With Admin By Request, when the change is so miniscule it\u2019s barely noticeable, the need for more support from Help Desk simply isn\u2019t there.<\/p>\n\n\n\n 5. Lack of visibility<\/strong><\/p>\n\n\n\n You may be concerned about a lack of visibility into what a PAM<\/strong> software solution would actually be doing: what are end users using their local admin rights for? System tools? App updates? Legacy applications? If you\u2019re going to manage user access, you at least want to know what, exactly, your users are accessing and why.<\/p>\n\n\n\n Admin By Request recognises that transparency is important. That\u2019s why this solution gives you full visibility of what your end users are using their local admin rights for. With the software\u2019s Learning Mode, you get a full breakdown of what your users are doing before admin rights are revoked. You can see the patterns, trends and outliers, and you can use this data to decide which applications should be whitelisted when the time for revoking comes around. Once admin rights have been revoked, you\u2019ll know who\u2019s doing what because requests for elevation, along for a reason for the request, will appear in real time within the Admin By Request user portal and in the mobile application. On top of that, everything your users do while they are running an application as administrator or having an elevated session is recorded in the auditlog. Visibility = check.<\/p>\n\n\n\n 6. Solutions being too complicated<\/strong><\/p>\n\n\n\n Many PAM<\/strong> solutions take over 9 months to deploy. They involve lots of new back end servers, expensive licenses, IT training and project managers. This means lengthy set up times, costly changes, extra people needing to be involved, and valuable time being spent on re-education rather than work.<\/p>\n\n\n\n Admin By Request is somewhat a rarity: with 90% of customers having the software fully implemented within 3 months, meaning you get a very positive return of investment and a secure IT environment in a short span of time. The reason for this lightning-fast setup is because there is no infrastructure needed and no AD Sync or ADFS required. The installer MSI file itself is a tiny 2.58 megabytes which takes seconds to install, and basic setup within the Admin By Request user portal can be done in minutes.<\/p>\n\n\n\n 7. Why make the change when nothing has gone wrong?<\/strong><\/p>\n\n\n\n You\u2019ve gotten this far without your company burning to the ground, so why stop now? Ambition: In this case, the preference to gamble that nothing goes wrong rather than settle for a PAM<\/strong> solution that doesn\u2019t cover absolutely everything.<\/p>\n\n\n\n Admin By Request is a solution that is both simple and covers everything. It takes one unchecked end user with local admin rights to potentially compromise your entire network \u2013 don\u2019t take the risk.<\/p>\n\n\n\n Although it\u2019s easy to be put off by the many PAM<\/strong> solutions out there that are tiresome, expensive and difficult to implement and work with \u2013 the right solution really can be easy peasy (as cheesy as that sounds).<\/p>\n\n\n\nNot So Easy Peasy<\/h2>\n\n\n\n
It\u2019s as Easy as (Lemon) Pie<\/h2>\n\n\n\n
Conclusion<\/h2>\n\n\n\n