102

I work at a small tech company as a software developer. Everyone in the office, including myself, has to ask our manager to come over (or VPN into our machines) to type in their password at least once a day to bypass an admin privilege lock.

I'm not talking about the password being required just to download trusted programs like Notepad++; I can't even update software, like Notepad++, on my machine without the manager's password.

As a technical person, as hopefully all programmers are, I sort of find it insulting that I'm not even trusted to download or update my programs.

Another developer and I have asked management to have those permissions granted so that we don't have to ask the manager for his password every time there's an update but the first attempt was futile. Any suggestions or is this not worth the effort?

  • 55
    Most companies don't give their users admin privileges, even technically-minded ones. I doubt you're going to get much out of this. – David K Apr 20 '16 at 14:26
  • 20
    Do you really have to download or update new software everyday? – undefined Apr 20 '16 at 14:29
  • 199
    I'm surprised at the site's reaction to this. I'd like to think that people who spend their days building and testing have the basics of working with a computer down. Standard practice where I worked was that if you got admin privileges on your local machine, support for it would be limited to a wipe and reinstall. Developers having admin rights on their own machines is a common addendum to the Joel Test for a reason. – Lilienthal Apr 20 '16 at 16:24
  • 7
    Closely Related (but closed for some odd reason): As a developer, how can I ask for more freedom when confronted with a tight IT security policy? – reirab Apr 20 '16 at 21:44
  • 7
    This seems absurd and based on the answers I guess it differs a lot from regions in the world. Where are you based? In Sweden this would never (ever) be accepted as a developer. Personally I'd leave the company in a heartbeat, why should I care and be passionate about my job if I don't get trusted with one of the basic requirements, jeez. – sebbzzz Apr 22 '16 at 11:09

16 Answers 16

137

If you're developing FOR Windows, then you need admin rights. Period. I've never, in 20 years, been anyplace that worked differently. If this is the case, starting looking as you're only gonna frustrate yourself over time. It will hit the wall when the manager takes vacation.

  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. – enderland Apr 21 '16 at 19:15
  • There are some high security situations that involve vast amounts of sensitive data where I have been forced to request admin access, at least for a while. There are simply some situations where you really can't trust a developer to have admin access to their machine because maintaining privacy is more important than productivity. – Mark Rogers Apr 23 '16 at 13:53
  • 8
    -1, this doesn't answer the question at all. It just reiterates that there's a problem. Then offers the solution of "look for another job" which is a non-solution. – user42272 Apr 25 '16 at 1:44
  • 2
    and if you are not developing for windows, you don't need windows (but you still need admin privileges.) – njzk2 Aug 12 '16 at 14:17
75

Unless you can provide a business case that makes sense to management, then yes it is inappropriate to push back on the policy further.

However if you can provide a business case that makes sense then absolutely go forward. But you will need to be prepared to defend that business case and answer questions about it.

Management is more likely to consider changes if the current policy:

  • causes the team to be unable to meet the requirements of a contract
  • seriously impacts deliverables to the customers
  • costs a significant amount of money to implement or enforce.
  • is or will be in violation of the law or a contract

Alternately if you can show that a change in the policy will save or earn a significant amount of money through added productivity or new opportunities for sales or income.

  • 9
    A business case seems very easy to make... Employers will quit their jobs out of frustration and replacing them is very costly. – Thomas Bonini Apr 23 '16 at 9:35
  • 4
    @AndreasBonini that's a terrible business case if it's not supported by an actual business case. – user42272 Apr 25 '16 at 1:48
60

This policy is absurd. As a developer, in all companies I worked for, I always had full control over my work computer (and I would probably not want to work for a company where it is not the case anyway - but the opportunity never presented itself).

Considering a small company large enough to have such policy, you are probably at least 50 people?

What you are saying is that basically managers are spending, say, 5 minutes per day per user, i.e. roughly half the day typing a password for other people, which are waiting for that to happen, which accounts for another half day of lost productivity. (Not even mentioning scheduling overhead, I don't assume your manager is always readily available to type in their password.)

Basically your company is paying a full-time salary just to prevent you from downloading Notepad++.

This makes zero sense to me.

So yes, you should be pushing back, encouraging your colleagues to push back, talk about it with your manager, your HR, and whoever could have a saying in this matter. Someone will realize that this policy is annoying, getting in the way of getting work done, and taking time from the managers.

And don't hesitate to ask your manager to come type their password as often as required, because whatever software you succeed in installing, those are only safe (if at all) as long as up-to-date. There is nothing worse than a 3-year-old browser never updated.

  • Kind of wonder what "full control" means to you. – user42272 Apr 25 '16 at 1:49
  • @djechlin pretty much anything you'd imagine, I suppose. Admin rights on the current install, obviously, but also the possibility to install another os, when it makes sense and does not interfere with my ability to do my job. All the things being logically limited by the fact that any expense has to be approved first (be it a software license or a piece of hardware.). – njzk2 Apr 26 '16 at 2:07
  • I wonder what layer they installed their keylogger. – user42272 Apr 26 '16 at 2:28
26

As a developer I get your frustration, but I have been system support and developers can also be the most irresponsible users. Not saying you, but some will download and install almost anything. For Microsoft stuff, Windows Update will perform without you being an administrator. The problem with giving administrator privileges is that puts virus software one step closer to running as administrator. Software updates to non-Microsoft stuff can be controlled with Group Policy.

I get it is a pain and for some developers, you pretty much need to be an administrator. I write LOB applications and happen to be an administrator, but I only need elevate my privileges a couple of times a year.

It is not about Notepad++.

  • What if a developer downloads a free add on, but the problem is the license does not cover commercial use? The application ships and the company is sued for violating the license.
  • The free download contains spyware or malware.
  • An unknown add on breaks support or breaks on the next upgrade to the base software.
  • There needs to be a standard / controlled development environment. If developers are administrators, then it is just a lot harder to control that.
  • 18
    +1 for "developers can also be the most irresponsible users". Many times I've heard developers complaining about how they updated to the latest release of .NET/Java/whatever and now something doesn't work. – TMN Apr 20 '16 at 17:45
  • Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Apr 22 '16 at 13:09
13

You'll need to provide a valid return on investment for such a change. If the manager needs to spend time understanding each time you need admin privileges, and then provides the password, there is a lot of time spent on that task. If the manager is just typing it in, without understanding your needs, it's a needless bottleneck.

In either case, many companies use software for temporarily elevating privileges. I don't know how expensive it is for a smaller company, but it allows you to type in a reason, elevate your privileges for the specific task, and logs it.

You could advocate to replace the manager's time with a program like this. If the cost was less than the time the manager is spending (and it very well may be), that is a selling point. In addition, it is available even when the manager is on vacation or in off hours, it tracks who needs it and for what, and it frees up the manager for more useful work. Write up a case, and perhaps you could get a better system that still provides the security they want.

13

Would it be inappropriate

Yes, it would. These things are done for security reasons. Your manager quite possibly has no say in the matter and would have to escalate to get the protocols changed. While it may seem a waste of time to you and even a bit offensive, it's not usually an arbitrary decision made just to annoy you.

If it's done by a firewall, then these are usually set up manually to comply with a company's specific needs rather than left at default. If it's group policy or blocks on the actual machines then a system administrator did it (not by accident because it's not default behaviour). Someone has not only set a password, but outlined the proper procedure to the manager (assuming the manager didn't do it himself), in either case you have asked and been declined. Nothing in your question suggests that anything constructive will come of pushing against this policy.

  • 5
    +1 simple and to the point. Those of us who are in IT and KNOW what we are doing tend to forget that the policies are not made for us, but for the idiots who don't know what they're doing. Truth be told: Many IT people overestimate their skill. When I was young and cocky, I accidently overwrote my HDD. Policy exists for the exact reasons you outline. – Retired Codger Apr 20 '16 at 14:41
  • 3
    There are also companies in which the manager who initially set up the firewall simply does not understand some of its finer functions, and thus the agonizingly tedious behavior is not the result of Fort-Knox level security, but simply poor firewall management. In that case asking whomever is in charge to finally set it up properly is not inappropriate but advisable - for the good of the company. At my current job the firewall was set to some default profile, and we had to bed the manager to allow access to certain sites - even stack exchange. Was I out of line to do so? No. – AndreiROM Apr 20 '16 at 17:02
  • 12
    @RichardU If I know what I'm doing and the policy hampers my work, then I think it's a bad policy. – svick Apr 20 '16 at 19:14
  • 2
    Umm... Yes, requiring admin rights to install or update programs or to change security-sensitive system settings most certainly is default behavior. On pretty much all modern operating systems. – reirab Apr 20 '16 at 21:38
  • 2
    @AgentRoadKill - yup.My downloads are important to me. – AndreiROM Apr 21 '16 at 17:58
3

Your normal account shouldn't have local admin privileges, frankly, no matter who you are or what you do. It's dangerous and unnecessary.

Most workplaces won't allow local admin privileges for any reason; they have helpdesk staff to do things like updates (and those should be handled by them, or by automatic processes). If you're doing lots of little updates, maybe you should batch them together and have the admin account log in just once a week or something to do it.

Really, though, it sounds like the problem is more that your boss is the one with admin rights. That's not the point of restricting admin rights; your boss shouldn't be the one with the rights anyway, and he/she shouldn't have to take time for things like this.

I would use this as a lever: tell your boss he/she is wasting his/her valuable time. Instead, there should be a privileged local account that doesn't have logon rights that you have which you can use to elevate privileges when you need to. Agree to log each use of it, and/or show your boss how to track use of the account using windows logs, if he/she is concerned about what you install.

  • 7
    I don't want to be harch here, but this is stupid. A developer absolutely should have admin rights. If you don't trust a developer with admin rights on his own workstation I don't think you should hire that developer to begin with. It takes a lot of useless time and energy to enforce this policy and it will severly harm moral and creativity when the developer isn't allowed to install the tools he/she needs. – sebbzzz Apr 22 '16 at 14:13
  • 1
    It has zero to do with trust, and entirely to do with proper procedure. As you notice, I suggest that if he actually needs them, he ask for a separate privileged account to elevate when needed - that's the correct way to do things. But "developer" is a very, very wide term, and many developers absolutely do not need local administrator privileges to do their day to day jobs. – Joe Apr 22 '16 at 14:15
3

As some others said, the policy does make sense in some circumstances (e.g. security firm who can't risk damage to reputation in case of breach, enterprise which needs a one-size-fits-all approach, or a firm in brokerage or medical business which might be subject to fines unless security is tight).

As others again have said, it doesn't make sense in some circumstances (e.g. anywhere where security breaches are not terrible if they happen).

Figure out how important this is to you, and if your company is in the first or second group. It's only worth fighting for if this is important to you and your company is in the second group.

Management decides on a wide range of topics while having to little to no knowledge on the subject matter, that's their job. So to make them agree to a change, first figure out what exactly the benefits and drawbacks of the change will be for the business and let them know about them. Write the list of reasons down, then simplify them into a summary with bullet points that fit on half a page. Create a document where that half page summary is the first page, and the more in-depth reasoning is on the following pages.

Hand them that document and hope for the best.

3

One solution that has not been brought up, that I have seen work in the past is to virtualize your development workspace.

Develop on a virtual machine (VM). Your computer will then only be used to host VMs (or not, if you use a server) and check emails. You can have administrator permissions on the VM and IT can stop worrying.

This is also handy if you're modifying your environment and want to be able to revert to a previous setting.

This works in large companies where you have the money for licenses and hardware; I am not sure how easy it is to implement in a smaller workplace. The server solution allows for development with low-end hardware on the client side. Maybe you could push for that as an alternative to updating developer computers for the next few years.

2

You say you are a small company. This does have some bearing on the answer.

A lot of companies give developers a lot of scope with what they do with their PCs. Some don't and developers get stuck trying to use their workstation with the same confines as all other employees.

Smaller companies can be very set in their ways. They may have one or two sysadmins who do things their way, and don't want to change. There could even be a bit of job security involved. If they spend a percentage of their week helping you download, they look more busy to management.

At the company level there is a balance between security and productivity. Developers often have more software and need to do more with their machines than most employees. So your productivity suffers more. Ultimately it is up to management to decide if they can take risk for increasing your productivity.

Having said all of this you can still potentially do something about it.

  • Befriend the sysadmins. Talk to them get them to realize that you are not a loose cannon and you understand security. At the very least this will make it more pleasant for everyone when you need to get things updated.
  • Install and update a lot of software, possibly more than the absolute minimum you need. Make sure that it becomes a drag on the sysadmins to update your software all the time.
  • Mention to everyone how good the sysadmins are and how much you hate wasting their time, and point out other tasks they could be completing if they were not so often having to help you install things.

This may not work, and is totally passive aggressive, but it could get the penny to drop that the company is not allocating resources appropriately.

  • Making more work by installing unneeded software is more likely to increase restrictions – Joe W Apr 24 '16 at 15:48
2

EDIT: I re-read your question. You asked if it was appropriate to ask, I didn't directly answer that. I'd go ahead and ask, with the backup plan of an inter-departmental team in my back pocket for the inevitable 'no', after all, what are all the other devs doing? Have they asked? What happened to them? 'Appropriate' is much harder to answer than 'what will happen'. 'Appropriate' depends more on your workplace than your end goal.


Being a current sysadmin and having worked in a development group, I feel semi-uniquely qualified to answer this.

To start: it can't hurt to ask*, but the answer is 'no' with p<0.05.

Let's move on to why: Imagine you own a bus company. You have buses you need to maintain, and drivers that you hire, and then train and trust to drive your buses. Some of your customers take the bus to the park, some to work, and some use it to make out on, but all your customers use the bus in the same way. One day, one of your customers comes to you and says that the buses drive too slowly and volunteers to drive the bus himself. He is, in fact, Juan-Pablo Montoya, winner of both NASCA and Formula 1 races, so he is certainly qualified to drive. Do you let him take the wheel?

That is how your IT department will see you. They gain no real benefit other than maybe the devs not complaining as much and open themselves up to more problems as developers like to 'play' with their things, and sometimes break them if they decide to close a port that the internal proxy requires you have open, or create a BIOS password for their workstation (ask how I know this).

Additionally, the IT department is subject to political forces that unless you are a lead engineer on the dev team you are likely not even aware of. I remember one time someone came to me explaining that they needed unrestricted internet access and that it should be easier to attain. I told him that if he could convince the CFO why he (the requester) should have full internet access, while the CFO lacked it, I would grant him internet access (I do not know if he attempted this, but I do know he did not get what he was looking for).

Suggestion talk to your manager. Unless he is ego-maniacal or sadistic, it is unlikely he enjoys entering a password for you all the time (probably for accountability purposes). See if, when there is less pressure on the dev team, there could be a small cross-department (IT + dev) team working on improving internal structure. Maybe one of the devs wants to write a script to automate what the dev team needs to be done, or maybe the IT department could use someone to cook up some config files while they support other users who's printers are 'broken', but really the paper tray is empty.

*Unless you have an extremely vengeful IT department, in which case, yes, it can hurt to ask

2

The lack of admin rights on your PC is there for a reason. That reason is that they want to prevent illicit code (malware) from entering your PC and thus their network.

HOWEVER, it appears they put that policy in place without also enacting proper monitoring or enforcement. From the way you describe it, your manager blindly authorizes anything you or your colleagues ask him to authorize. That is silly, and if it is true, then you should be permitted to install your own software.

COUNTERPOINT: Perhaps your manager really does take a look at what you're downloading and if you were doing something illicit, he might not authorize for you. If this is true, then your employer's controls are working and you will get nowhere with a pushback.

Risk is big these days and everyone is enacting limits so that no one employee can take down a company. Your company just seems to have put a rather manual process in place; one that may be annoying your manager as much as you.

0

You wrote that you work as a software developer. To debug binary programs, your account needs "debug" rights, as it allows to set "CPU traps", which are equivalent to breakpoints in your IDE, and to read (or write) arbitrary memory.

All of this is probably necessary for your daily work. It turns out that debug rights are (almost) the same as admin rights, as both allow you to completely control the machine, and to enable their counterpart if you wish so.

I'm confused how your manager keeps entering the password every time you run a program you developed to debug it?

  • 1
    If this is true, why is it that I can run debuggers like Visual Studio or gdb for Windows without admin rights on my Windows account? I only change to admin when installing software (that's the use case the OP is considering). – Brandin Apr 22 '16 at 8:46
  • If you debug native software in VS without admin rights on the VS process, it will usually ask you for elevation of rights. Without it, debugging will only be partially possible. --- This post is of course leaving out a ton of details (and I'm not an expert on this topic), so maybe your situation is slightly different and not directly applicable. – mafu Apr 22 '16 at 20:52
  • 1
    It's a problem with visual studio not with debug needing admin rights. There is no reason in principle this needs to exist. – Joshua Apr 23 '16 at 15:06
0

It is no more and no less inappropriate than bringing in your own laptop to do your work. If you're admin, from a security point of view, it's really your computer.

Some places are ok with that. Look up BYOD. Some are not. You work for a company. A company must decide which they want to do. Not just you. It's not impossible to develop code on machines that are in the wild. That's what most open source does.

However, if they currently do not and you want to push for this you are definitely stepping on the IT security guys toes. What that person thinks about your idea might be more important than the CEO's opinion. Then again they might love the idea.

You can push by making demands and threatening to leave over it.

You can push back by forming a plan, selling people on it, building a consensus, and doing the actual work.

It's your choice. Neither is inappropriate if done professionally. Either can end up with you updating your resume. I know what I'd put my money on.

0

You are going about this the wrong way. Right or wrong the company has a policy in place that they believe in and in order to get a change you will have to show them why it needs changed. One of the best ways to do this is to show them how much money the policy is costing them and how much they could save by changing it. The best and easiest way to do this is to start tracking time that it takes to do this.

What you need to do is track the time spent when a manager is needed to enter a password. By tracking the time that you lose every day/week/month waiting on passwords to be entered you will start to build an argument for fixing the system. When doing this you should also try to get your coworkers and manager on-board with this tracking as well. If you can show that the company is losing a good chuck of time to this process they will be more open to finding a solution that will work for everyone involved. However remember they may just find a better way to automate updating of the installed software rather then just give you admin permissions on your computer.

What needs to be remembered when trying to change a company policy you need to have solid evidence as to what the problem is, what the change should be and how it will benefit the company. Just complaining and saying something takes a lot of time with no evidence to back it up will never work in the long run.

-2

Yes you should push back.

It doesn't even sound like your manager is checking what you are installing, just wasting minutes of his day to let you install whatever you want. This is a case of cutting out the middle man if I ever saw one, he is essentially a repository for the passcode.

protected by Jane S Apr 22 '16 at 8:48

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.