Remote Users

[dd1313]

Hi Guys

I am interested to find out from IT admins how they handle the access given to remote users.
We have a few reps with laptops and I gave them standard user access on Win 7, but I
find that WIN 7 calls for the administrator password too often, is there a way to
set it up so that it does not, but at the sametime not giving the guys admin access
to install programs etc,

Thanks
DD

 

[bubbatentoe]

The problem with remote (on the road) users is that they always want to do things that require local admin rights.

same as with Windows XP users, we just join their laptops to the domain and then add their domain username to the local admin group on the laptop.

They're a local admin but still cannot perform tasks that require the domain admin password.
They always login as domain user.

They cannot uninstall the anti-virus/spyware or disable it (it's controlled by a domain server)
And that's all I'm really worried about.

The worst that happens is they:
a) install IE & Firefox toolbars
b) install "check my PC" tools by accident.
c) install all kids of silly little tools & programs which they somehow think they need.

Once every 4 months we check their PC's and "clean" them.

so they're happy because they have some autonomy
and we're happy because we still have some kind of control.

We also use "Active Directory integrated VNC" & Cisco VPN Client in order for them to connect remotely so we can do remote maintenance tasks when they call us with a problem.

also, the users sign a document saying they "agree & understand" that the PC is not theirs and they're not allowed to use it as a personal machine (no installing i-tunes or anything like that).

 

[unskinnybob]

Can't power users install stuff local?

Let's face it - if you have 100% control of your environment, reps won't need to install anything. Need to install means a gap.

 

[hungrybeaver]

Hi Guys

I am interested to find out from IT admins how they handle the access given to remote users.
We have a few reps with laptops and I gave them standard user access on Win 7, but I
find that WIN 7 calls for the administrator password too often, is there a way to
set it up so that it does not, but at the sametime not giving the guys admin access
to install programs etc,

Thanks
DD

I give my out & about users local admin rights on their laptops. A lot of them are technical people who walk around refineries and plants, and they require very odd drivers and software to be able to read the various telemetries, devices, pumps etc (fffuuuu usb-to-serial adapters). Without the admin access they'd be pretty useless on site. They're also not stupid users, which definitely helps

I think what you can do (haven't tried myself) is assign the user to the Users group (so they can't install etc without Admin help), and then give the user rights to the folder(s) where the specific software is that they need to use. I've done this in a server environment and not on the desktop and it has worked. I'd like to think it would work the same in Win7, though. Create a dummy user on your PC and test it out.

Can't power users install stuff local?

They can install software that doesn't affect Windows system files afiak.

Let's face it - if you have 100% control of your environment, reps won't need to install anything. Need to install means a gap.

Nope. This varies on the company and the type of work they do.

 

[unskinnybob]

Nope. This varies on the company and the type of work they do.

How big a variety? My employer dabbles in banking/finance, retail, manufacturing, etc. Regardless, the amount of apps required are known and controlled.

 

[hungrybeaver]

If you can have an environment where people use X software to do Y task then it is easy to control. All my stay-at-the-office users are easy to manage because everything they need is already installed.

Well as I said above, a few of my users visit plants & refineries and often plug devices into their computer through other cables to read data. A lot of these devices are legacy items and finding drivers is a mission, let alone trying to get them to work. The software used is not always from big companies but rather created by end users for specific tasks. It is unrealistic to have every driver and software installed on their computers all ready to go. To lock them down so they can't install anything is only slowing them down.