1

This is on a Windows 10 system, that is provided to me by work. They want to create an administrator account that only my manager will have the password to. The thing is, this isn't from IT and it's for the manager to access. I'm a developer, already have administrator access and it's a small company.

To me in my limited knowledge, it seems like there's a couple of possibilities

  • To create a backdoor to RDP and/or install monitoring software.
  • Gain access to my files remotely or while I'm away.
  • Potentially have a way to reclaim the computer if I were to leave

What access does creating a secondary administrator account provide them? What could some other motives be for doing so? Is this common practice in other larger companies? Are there security reasons behind it?

closed as unclear what you're asking by gnat, paparazzo, Dawny33, Masked Man, AndreiROM May 6 '16 at 18:25

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Why not ask the IT department? This is a weird request coming from the manager directly. – Nelson May 4 '16 at 6:53
  • Where are you located? Privacy laws differ. The computer does belong to the company. If you are an Administrator then you can change passwords and delete accounts so if you left on bad terms this does not do much good. Also as admin you can see event logs and what is installed. On top of all that you should be on a Domain where he could just get domain access via IT. – paparazzo May 4 '16 at 11:33
  • 6
    Its a company asset. The company can do whatever they want with it. Don't use it for anything you don't want the company aware of. End of problem... – brhans May 4 '16 at 13:36
  • 5
    "Gain access to my files" <- everything on a work machine is the company's files. They have the right to monitor your use of the machine, etc. – AndreiROM May 4 '16 at 13:38
  • 1
    Have you asked your manager why he needs the admin account? – Masked Man May 5 '16 at 2:22
11

Does your company have an IT department? If so, your manager should definately talk to your System Administrator to see if this is all in the green.

Otherwise, if your company doesn't, who generally set up these computers? If its not an external contractor, your manager should talk to that person instead.

Its not your place to modify network and account configurations behind the back of your IT people. This could only end badly.

As to why he wants this, there are several possibilities:

  • Contingency if you leave (Do you guys have a Domain? If so this is unnecessary)
  • He wants to monitor your activities and doesn't want you to notice
  • He plans on making Administrator unavailable to you and instead have you contact him when you need it
  • He thinks he needs it but really doesn't but has no idea because he's not a Systems Administrator

All of these point to that he should ask through the proper channel for this, instead of through you.

3

This would normally be the IT people. But there are reasons why it's good to have more than one admin account. The reasons you already stated plus such issues as a corrupt profile on the only admin account or the need to use your machine for work while you are not there etc,. Even on a domain there is a use for another local admin account (rare, but when you need it, you need it) in some disaster recovery situations.

Best option is ask your manager what it's for if you're worried about it. But really there isn't much you can do about it, and you shouldn't have anything on your machine that your manager can't look at anyway.

Not the answer you're looking for? Browse other questions tagged or ask your own question.