Would it be inappropriate for me to push back on download privileges on my work PC?

Question

I work at a small tech company as a software developer. Everyone in the office, including myself, has to ask our manager to come over (or VPN into our machines) to type in their password at least once a day to bypass an admin privilege lock.

I'm not talking about the password being required just to download trusted programs like Notepad++; I can't even update software, like Notepad++, on my machine without the manager's password.

As a technical person, as hopefully all programmers are, I sort of find it insulting that I'm not even trusted to download or update my programs.

Another developer and I have asked management to have those permissions granted so that we don't have to ask the manager for his password every time there's an update but the first attempt was futile. Any suggestions or is this not worth the effort?

Answer 1

If you're developing FOR Windows, then you need admin rights. Period. I've never, in 20 years, been anyplace that worked differently. If this is the case, starting looking as you're only gonna frustrate yourself over time. It will hit the wall when the manager takes vacation.

Answer 2

Unless you can provide a business case that makes sense to management, then yes it is inappropriate to push back on the policy further.

However if you can provide a business case that makes sense then absolutely go forward. But you will need to be prepared to defend that business case and answer questions about it.

Management is more likely to consider changes if the current policy:

• causes the team to be unable to meet the requirements of a contract
• seriously impacts deliverables to the customers
• costs a significant amount of money to implement or enforce.
• is or will be in violation of the law or a contract

Alternately if you can show that a change in the policy will save or earn a significant amount of money through added productivity or new opportunities for sales or income.

Answer 3

This policy is absurd. As a developer, in all companies I worked for, I always had full control over my work computer (and I would probably not want to work for a company where it is not the case anyway - but the opportunity never presented itself).

Considering a small company large enough to have such policy, you are probably at least 50 people?

What you are saying is that basically managers are spending, say, 5 minutes per day per user, i.e. roughly half the day typing a password for other people, which are waiting for that to happen, which accounts for another half day of lost productivity. (Not even mentioning scheduling overhead, I don't assume your manager is always readily available to type in their password.)

Basically your company is paying a full-time salary just to prevent you from downloading Notepad++.

This makes zero sense to me.

So yes, you should be pushing back, encouraging your colleagues to push back, talk about it with your manager, your HR, and whoever could have a saying in this matter. Someone will realize that this policy is annoying, getting in the way of getting work done, and taking time from the managers.

And don't hesitate to ask your manager to come type their password as often as required, because whatever software you succeed in installing, those are only safe (if at all) as long as up-to-date. There is nothing worse than a 3-year-old browser never updated.

Answer 4

As a developer I get your frustration, but I have been system support and developers can also be the most irresponsible users. Not saying you, but some will download and install almost anything. For Microsoft stuff, Windows Update will perform without you being an administrator. The problem with giving administrator privileges is that puts virus software one step closer to running as administrator. Software updates to non-Microsoft stuff can be controlled with Group Policy.

I get it is a pain and for some developers, you pretty much need to be an administrator. I write LOB applications and happen to be an administrator, but I only need elevate my privileges a couple of times a year.

It is not about Notepad++.

• What if a developer downloads a free add on, but the problem is the license does not cover commercial use? The application ships and the company is sued for violating the license.
• The free download contains spyware or malware.
• An unknown add on breaks support or breaks on the next upgrade to the base software.
• There needs to be a standard / controlled development environment. If developers are administrators, then it is just a lot harder to control that.

Answer 5

You'll need to provide a valid return on investment for such a change. If the manager needs to spend time understanding each time you need admin privileges, and then provides the password, there is a lot of time spent on that task. If the manager is just typing it in, without understanding your needs, it's a needless bottleneck.

In either case, many companies use software for temporarily elevating privileges. I don't know how expensive it is for a smaller company, but it allows you to type in a reason, elevate your privileges for the specific task, and logs it.

You could advocate to replace the manager's time with a program like this. If the cost was less than the time the manager is spending (and it very well may be), that is a selling point. In addition, it is available even when the manager is on vacation or in off hours, it tracks who needs it and for what, and it frees up the manager for more useful work. Write up a case, and perhaps you could get a better system that still provides the security they want.

Answer 6

Would it be inappropriate

Yes, it would. These things are done for security reasons. Your manager quite possibly has no say in the matter and would have to escalate to get the protocols changed. While it may seem a waste of time to you and even a bit offensive, it's not usually an arbitrary decision made just to annoy you.

If it's done by a firewall, then these are usually set up manually to comply with a company's specific needs rather than left at default. If it's group policy or blocks on the actual machines then a system administrator did it (not by accident because it's not default behaviour). Someone has not only set a password, but outlined the proper procedure to the manager (assuming the manager didn't do it himself), in either case you have asked and been declined. Nothing in your question suggests that anything constructive will come of pushing against this policy.

Answer 7

Your normal account shouldn't have local admin privileges, frankly, no matter who you are or what you do. It's dangerous and unnecessary.

Most workplaces won't allow local admin privileges for any reason; they have helpdesk staff to do things like updates (and those should be handled by them, or by automatic processes). If you're doing lots of little updates, maybe you should batch them together and have the admin account log in just once a week or something to do it.

Really, though, it sounds like the problem is more that your boss is the one with admin rights. That's not the point of restricting admin rights; your boss shouldn't be the one with the rights anyway, and he/she shouldn't have to take time for things like this.

I would use this as a lever: tell your boss he/she is wasting his/her valuable time. Instead, there should be a privileged local account that doesn't have logon rights that you have which you can use to elevate privileges when you need to. Agree to log each use of it, and/or show your boss how to track use of the account using windows logs, if he/she is concerned about what you install.

Answer 8

As some others said, the policy does make sense in some circumstances (e.g. security firm who can't risk damage to reputation in case of breach, enterprise which needs a one-size-fits-all approach, or a firm in brokerage or medical business which might be subject to fines unless security is tight).

As others again have said, it doesn't make sense in some circumstances (e.g. anywhere where security breaches are not terrible if they happen).

Figure out how important this is to you, and if your company is in the first or second group. It's only worth fighting for if this is important to you and your company is in the second group.

Management decides on a wide range of topics while having to little to no knowledge on the subject matter, that's their job. So to make them agree to a change, first figure out what exactly the benefits and drawbacks of the change will be for the business and let them know about them. Write the list of reasons down, then simplify them into a summary with bullet points that fit on half a page. Create a document where that half page summary is the first page, and the more in-depth reasoning is on the following pages.

Hand them that document and hope for the best.

Answer 9

One solution that has not been brought up, that I have seen work in the past is to virtualize your development workspace.

Develop on a virtual machine (VM). Your computer will then only be used to host VMs (or not, if you use a server) and check emails. You can have administrator permissions on the VM and IT can stop worrying.

This is also handy if you're modifying your environment and want to be able to revert to a previous setting.

This works in large companies where you have the money for licenses and hardware; I am not sure how easy it is to implement in a smaller workplace. The server solution allows for development with low-end hardware on the client side. Maybe you could push for that as an alternative to updating developer computers for the next few years.

Answer 10

You say you are a small company. This does have some bearing on the answer.

A lot of companies give developers a lot of scope with what they do with their PCs. Some don't and developers get stuck trying to use their workstation with the same confines as all other employees.

Smaller companies can be very set in their ways. They may have one or two sysadmins who do things their way, and don't want to change. There could even be a bit of job security involved. If they spend a percentage of their week helping you download, they look more busy to management.

At the company level there is a balance between security and productivity. Developers often have more software and need to do more with their machines than most employees. So your productivity suffers more. Ultimately it is up to management to decide if they can take risk for increasing your productivity.

Having said all of this you can still potentially do something about it.

• Befriend the sysadmins. Talk to them get them to realize that you are not a loose cannon and you understand security. At the very least this will make it more pleasant for everyone when you need to get things updated.
• Install and update a lot of software, possibly more than the absolute minimum you need. Make sure that it becomes a drag on the sysadmins to update your software all the time.
• Mention to everyone how good the sysadmins are and how much you hate wasting their time, and point out other tasks they could be completing if they were not so often having to help you install things.

This may not work, and is totally passive aggressive, but it could get the penny to drop that the company is not allocating resources appropriately.

Answer 11

EDIT: I re-read your question. You asked if it was appropriate to ask, I didn't directly answer that. I'd go ahead and ask, with the backup plan of an inter-departmental team in my back pocket for the inevitable 'no', after all, what are all the other devs doing? Have they asked? What happened to them? 'Appropriate' is much harder to answer than 'what will happen'. 'Appropriate' depends more on your workplace than your end goal.

---

Being a current sysadmin and having worked in a development group, I feel semi-uniquely qualified to answer this.

To start: it can't hurt to ask*, but the answer is 'no' with p<0.05.

Let's move on to why: Imagine you own a bus company. You have buses you need to maintain, and drivers that you hire, and then train and trust to drive your buses. Some of your customers take the bus to the park, some to work, and some use it to make out on, but all your customers use the bus in the same way. One day, one of your customers comes to you and says that the buses drive too slowly and volunteers to drive the bus himself. He is, in fact, Juan-Pablo Montoya, winner of both NASCA and Formula 1 races, so he is certainly qualified to drive. Do you let him take the wheel?

That is how your IT department will see you. They gain no real benefit other than maybe the devs not complaining as much and open themselves up to more problems as developers like to 'play' with their things, and sometimes break them if they decide to close a port that the internal proxy requires you have open, or create a BIOS password for their workstation (ask how I know this).

Additionally, the IT department is subject to political forces that unless you are a lead engineer on the dev team you are likely not even aware of. I remember one time someone came to me explaining that they needed unrestricted internet access and that it should be easier to attain. I told him that if he could convince the CFO why he (the requester) should have full internet access, while the CFO lacked it, I would grant him internet access (I do not know if he attempted this, but I do know he did not get what he was looking for).

Suggestion talk to your manager. Unless he is ego-maniacal or sadistic, it is unlikely he enjoys entering a password for you all the time (probably for accountability purposes). See if, when there is less pressure on the dev team, there could be a small cross-department (IT + dev) team working on improving internal structure. Maybe one of the devs wants to write a script to automate what the dev team needs to be done, or maybe the IT department could use someone to cook up some config files while they support other users who's printers are 'broken', but really the paper tray is empty.

*Unless you have an extremely vengeful IT department, in which case, yes, it can hurt to ask

Answer 12

The lack of admin rights on your PC is there for a reason. That reason is that they want to prevent illicit code (malware) from entering your PC and thus their network.

HOWEVER, it appears they put that policy in place without also enacting proper monitoring or enforcement. From the way you describe it, your manager blindly authorizes anything you or your colleagues ask him to authorize. That is silly, and if it is true, then you should be permitted to install your own software.

COUNTERPOINT: Perhaps your manager really does take a look at what you're downloading and if you were doing something illicit, he might not authorize for you. If this is true, then your employer's controls are working and you will get nowhere with a pushback.

Risk is big these days and everyone is enacting limits so that no one employee can take down a company. Your company just seems to have put a rather manual process in place; one that may be annoying your manager as much as you.

Answer 13

It is no more and no less inappropriate than bringing in your own laptop to do your work. If you're admin, from a security point of view, it's really your computer.

Some places are ok with that. Look up BYOD. Some are not. You work for a company. A company must decide which they want to do. Not just you. It's not impossible to develop code on machines that are in the wild. That's what most open source does.

However, if they currently do not and you want to push for this you are definitely stepping on the IT security guys toes. What that person thinks about your idea might be more important than the CEO's opinion. Then again they might love the idea.

You can push by making demands and threatening to leave over it.

You can push back by forming a plan, selling people on it, building a consensus, and doing the actual work.

It's your choice. Neither is inappropriate if done professionally. Either can end up with you updating your resume. I know what I'd put my money on.

Answer 14

You wrote that you work as a software developer. To debug binary programs, your account needs "debug" rights, as it allows to set "CPU traps", which are equivalent to breakpoints in your IDE, and to read (or write) arbitrary memory.

All of this is probably necessary for your daily work. It turns out that debug rights are (almost) the same as admin rights, as both allow you to completely control the machine, and to enable their counterpart if you wish so.

I'm confused how your manager keeps entering the password every time you run a program you developed to debug it?

Answer 15

You are going about this the wrong way. Right or wrong the company has a policy in place that they believe in and in order to get a change you will have to show them why it needs changed. One of the best ways to do this is to show them how much money the policy is costing them and how much they could save by changing it. The best and easiest way to do this is to start tracking time that it takes to do this.

What you need to do is track the time spent when a manager is needed to enter a password. By tracking the time that you lose every day/week/month waiting on passwords to be entered you will start to build an argument for fixing the system. When doing this you should also try to get your coworkers and manager on-board with this tracking as well. If you can show that the company is losing a good chuck of time to this process they will be more open to finding a solution that will work for everyone involved. However remember they may just find a better way to automate updating of the installed software rather then just give you admin permissions on your computer.

What needs to be remembered when trying to change a company policy you need to have solid evidence as to what the problem is, what the change should be and how it will benefit the company. Just complaining and saying something takes a lot of time with no evidence to back it up will never work in the long run.

Answer 16

Yes you should push back.

It doesn't even sound like your manager is checking what you are installing, just wasting minutes of his day to let you install whatever you want. This is a case of cutting out the middle man if I ever saw one, he is essentially a repository for the passcode.