How do you manage computer admin?

Posted by nodiaque@reddit | sysadmin | View on Reddit | 41 comments

Hello everyone, I was wondering how you manage your computer administrator in your domain? I'm not talking about domain admin or all computer admin but the users that are admin of specific computer. Currently, we are using GPP where I target a specific computer and add the user in it. This is very not efficient and very slow to process. Surely, there's a way to target user x is admin on computer y. i'm not Azure AD Join, I'm using SCCM to manage. Some computer have more then 1 account admin on the system. Please, keep the discussion on topic, we are not discussion if we should have user that are admin or not, there is many reason why user are admin here, specifically very old software that even Shim doesn't fix that cost billions to replace. Thank you

Reply to Post

Reply

41 Comments

[-]

TheProle@reddit

Users aren’t admins of their computers. Period. Ever. Admins have admin accounts that are members of an AD Group that is in the local admin group on all of your workstations.

Reply

[-]

nodiaque@reddit (OP)

Thank you, not the question, you don't know why they are. Not everything can be done.

Reply

[-]

TheProle@reddit

I support sorting machines that fill a large room and have been in service since the 90s, in a highly secure environment. We routinely parse and delegate permissions and we don’t give users admin rights. Ever.

Reply

[-]

EloAndPeno@reddit

I'm morbidly curious, which software has you in such a bind!? Also i agree with AD groups being added as admin on the computer, and the membership of that group determines access, then you can easily see in AD this information.

Reply

[-]

nodiaque@reddit (OP)

Problem with the ad group (which we already have). This give all the member admin to all computer that have this group. That's not what I need, I need a 1:1 relation. The list is over 200 applications. We are a 0ublic transit company and have software that goes to win 95 that we cannot change. We have over 1500 different software from all ages. We already had many firm come in and try to make these software work without admin rights and they can't, not even with shim. MS was one of them.

Reply

[-]

EloAndPeno@reddit

I would think you'd want a group per computer, created when the computer object is created, and a policy, or script that adds that group to admins.. on creation.. With the ones you've got now you could likely whip up a script to create the groups in AD, and toss that group on each computer, then you manage who is the 'admin' on each computer via those groups.. but this is all something someone else has also suggested :) I work in healthcare, so we've also had similar issues... but regulations forced our hand to pay the money for new software -- legalities, and being a big target can suddenly make options appear that didn't exist in the past.

Reply

[-]

nodiaque@reddit (OP)

Yeah, I understand the legalities. For use, it's multiple billions and with the fact that right now, we have budget cut and have 5.5 billions lost a year since covid, we can't afford to change this working machine. A pam/pum tool would be better in the end. I'll check the one already suggested in the thread.

Reply

[-]

disposeable1200@reddit

We don't give users admin, ever. Fix your processes and shim your applications.

Reply

[-]

Hexnite657@reddit

Both the big game companies I've worked at give everyone Admin, hasn't ever been a problem.

Reply

[-]

nodiaque@reddit (OP)

Thank yoy for not reading the post and doing exactly what I said not to do. You don't know squat, not everything can be fixed with shim.

Reply

[-]

disposeable1200@reddit

I can't help if you're doing it wrong. Last time I gave users local admin was 2013. I've worked everywhere from 5 users to 35,000 user environments and... None of them needed local admin. Even with some of the crazy software out there.

Reply

[-]

nodiaque@reddit (OP)

Number of user have nothing to do with it. Continue thinking there's only one way. MS compatibility team themselves where unable to do so. Same with 3 expert firm specialize in that. They all's aid replace the software, which require replace 60s hardware, which cost billions. Guest what. As a public transit company, we don't have the budget to replace fully working machine for billions.

Reply

[-]

disposeable1200@reddit

Enjoy your ransomware!

Reply

[-]

nodiaque@reddit (OP)

Not your problem. Not the question

Reply

[-]

lugnercity@reddit

i push a Group "ClientsLocalAdmin" to the local Administrators group of the Computer and add/delete Support/service Users to that group in AD as needed and the Local Administrator account is managed with LAPS. seems the most logical to me.

Reply

[-]

nodiaque@reddit (OP)

We have the same setup, but these has flaw. We do have LAPS. Pushing a group mean everywhere this group is pushed, all these user are admin. While we do have such concept for those that are admin of every computer like helpdesk, what I also have is user that either have an alt account with admin credential that they either runas or logon as when needed on their own computer or their own account as admin on that computer because software requiring it. These are a 1:1 allocation.

Reply

[-]

lugnercity@reddit

it should be obvious that the account IT uses for daily work have admin rights anywhere not even on our own workstations :)

Reply

[-]

nodiaque@reddit (OP)

Obvious and needs are 2 thing.

Reply

[-]

Lorentz_G@reddit

You could do it in Active Directory, IDK how many computers you got and I wont ask why "users" should have admin privilages. But a security group in AD and push it by GPO to the target computer. Then i can manage user rights in AD.

Reply

[-]

VplDazzamac@reddit

This is how I do it. The policy adds %computername%-admin to the local administrator. As a computer joins the domain, a security group in that format is created. Then we drop users into that group if they need local admin.

Reply

[-]

nodiaque@reddit (OP)

Oh so you have 1 group for each computer?

Reply

[-]

VplDazzamac@reddit

For servers yeah, separate admin account for administrators and the account gets added and removed as required.

Reply

[-]

nodiaque@reddit (OP)

Ok, I'm on client computer though. Admin server are like that too, a domain group for each server.

Reply

[-]

VplDazzamac@reddit

Same principle can apply for computers however.

Reply

[-]

nodiaque@reddit (OP)

Yeah, just with over 10 000 computers, that's a lot. True, it's not needed for all computer but still need a way to push this group to each computer. But also, how do you prevent someone admin from adding itself directly in the admin group after? Like if you put me in that group for 24h, I could put myself directly in the local admin group and then keep it.

Reply

[-]

VplDazzamac@reddit

GPO can replace the admin list. So they could add them in, but policy would remove them again.

Reply

[-]

nodiaque@reddit (OP)

Yeah that's what I have right now. Gpp that target each computer that need a user admin and add it. Trying to move away from that cause 300 Gpp line with targeting slow down GPO a lot. With a GPO that add the group, it would be essentially the samething.

Reply

[-]

nodiaque@reddit (OP)

Problem with a single group pushed to computer means all these users are admin of all these computer. Right now, I'm doing it by gpp

Reply

[-]

Pondering_Pounding@reddit

We used to do this before we had a PAM solution. Our GPO looked like this... Computer Configuration > Preferences > Control Panel Settings > Local Users And Groups In the pane on the right, New > Local Group. Select "Administrators" under Group Name, then add the user below. Then from the Common tab, use Item Level Targeting to have it apply to only the PC that user needs admin on.

Reply

[-]

nodiaque@reddit (OP)

Yeah that's what we are doing, I'm trying to move away from that. What is that Pam solution you are talking about?

Reply

[-]

Pondering_Pounding@reddit

We use ConnectWise Access Management. We were already using ScreenConnect, so it is an easy add-on. I also have a bunch of really old and/or poorly written apps that require local admin rights to even run, so it's been a big improvement.

Reply

[-]

nodiaque@reddit (OP)

Oh I'll check that, thank you!

Reply

[-]

bad_brown@reddit

PAM/PUM for the specific app and associated processes and services.

Reply

[-]

nodiaque@reddit (OP)

You mean azure Pam? Or you have a specific solution In mind?

Reply

[-]

bad_brown@reddit

I have used Threatlocker for this purpose. They have an elevation module that will run an app as local admin w/o the user needing to be full admin of the workstation. Someone else mentioned AutoElevate for this, and that product would work well also and likely be cheaper if that's all you want to use it for (Threatlocker does a lot of other stuff as their primary function with elevation add-on, AE is elevation w/ other stuff add-on available).

Reply

[-]

nodiaque@reddit (OP)

Oh, I'll have a check on that. Thank you

Reply

[-]

itishowitisanditbad@reddit

>Please, keep the discussion on topic, we are not discussion if we should have user that are admin or not, there is many reason why user are admin here, specifically very old software that even Shim doesn't fix that cost billions to replace. "I know its terrible practice, we have vapid excuses and no plans to resolve it. Nobody is allowed to judge us for some reason though" Yeah, nah.

Reply

[-]

nodiaque@reddit (OP)

Lol,. Yeah. You want the long story? Fine, here's you with your high horse. Public transit company with no funds. Over 1500 differents software and over 200 that are from w95 eta (and even some in dos). All these software are required for maintenance of bus or train. There is NO alternative software. Their are made specially for these bus and trains. Microsoft tried and 3 other company tried for 5 years to make them work without admin rights. Packaging specialist tried. Microsoft compatibility team tried with shim. Result? Cannot, need to change software. Changing software mean replacing train, bus, and a lots of other stuff around it. You know the cost of that? One of them is a simple as the little cleanup train that goes around the train track to cleanup everything. It's a robot. Programmation is done using a very old msdos software and nothing we tried work except that software. And the software doesn't work in dosbox or other emulation. Replacement of the hardware? 1.6 billions (priced in 2020). That's just the price for the machine itself. Doesn't include the programming of the software, scan of the subway system, training, recycling of the old working equipment. You think management care that we have a computer with someone admin VS replacing a working piece of equipment replaced for billions? No. That's just a very small exemple. Think what you want, you haven't seen everything in life and you know absolutely nothing of what we tried in the past decade to have all of these old software either replaced or adapt.

Reply

[-]

nakkipappa@reddit

You mean permanently admin? We used LAPS for the occasional stuff and more of a breakglass case. We never gave permanent adminrights to users.

Reply

[-]

nodiaque@reddit (OP)

Yes it's permanent admin. We do have laps too. But we have software that require admin rights to even run. Some, we use run as with a local admin. There's also some process where some user are admin with their admin account so when they need these access, they either login or run as this user. We don't want this user to be admin of all computer, just the want it need.

Reply

[-]

no_regerts_bob@reddit

We use a tool called AutoElevate to manage admin access. It lets you remove local admin rights from the user accounts and instead grant them based on the program or activity. There are other similar tools, not recommending this specific one exactly but maybe something like it would solve your problem.

Reply