Re: Running developers as standard users in Vista with UAC enabled

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Jeff Killberg <JeffKillberg@xxxxxxxxxxxxxxxxxxxxxxxxx>'s
wild thoughts were released on Thu, 7 Aug 2008 09:12:01
-0700 bearing the following fruit:

I am at a loss as to where to post this question, so I'll start here.

I have been given the task of researching Vista and UAC and the feasibility
of running developers in an enterprise as standard users (not admins) without
an additional set of administrator credentials to elevate to. In other words,
if they get blocked by anything in UAC they would not have the ability to
elevate themselves. Need to change something in HKLM? Nope. Wanna edit an ini
file under \Windows? Nope. Etc.

It doesn't make sense. Developers are going to have a hard
if not impossible time without admin rights.

Firstly, why have them as standard users if you are going to
furnish them with the admin password? It seems pointless no?

I'm an admin user although I run under UAC so in effect
anything I run has standard priveleges. I set my Visual
Studio to run 'as admin' so that it runs under admin rights.

No problems at all.

My definition of developers would include developers coding for Windows
using a tool like Visual Studio, as well as developers coding web apps using
a mix of tools such as VS, eclipse, Rational Software Architect, etc. These
developers will also have to deal with things like installation scripts,
configuration of software installations, etc.

Research I have found thus far has determined that this will be problematic
as you cannot (easily) define all of the 'exceptions' that a developer might
need to deal with on a regular basis and configure around these exceptions
such that the developer doesn't need to elevate. I would agree with this
assessment.

Anyone else have experience/examples in dealing with this? I am trying to
gather enough information/evidence to make a solid decision either way, and
would be curious as to other's findings.

Let them have admin rights or your going to make thier work
very very difficult.

--
Jan Hyde (VB MVP)

https://mvp.support.microsoft.com/profile/Jan.Hyde
.

Relevant Pages

  • Re: Running developers as standard users in Vista with UAC enabled
    ... kind of rubbish programs we see that won't run properly without admin rights. ... Plenty of rubbish but none that require admin. ... All .NET based line-of-business application developers should run as standard user, otherwise they'll end up writing the usual ...
    (microsoft.public.vsnet.general)
  • Re: Administrator Priviledges on local system.
    ... So don't give them the password for the admin account. ... developers doing stupid things that you then have to go in and fix. ... They want admin rights, ...
    (microsoft.public.security)
  • Re: Administrator Priviledges on local system.
    ... So don't give them the password for the admin account. ... developers doing stupid things that you then have to go in and fix. ... They want admin rights, ...
    (microsoft.public.win2000.security)
  • Re: IIS rights without being administrator
    ... > provide some of web/apps developers I work with the ability to ... > MMC with the IIS Admin snap-in, but, when they expand it to, they are ... > told they do not have sufficient rights and a dialog box appears ...
    (microsoft.public.windows.server.active_directory)
  • Re: Permissions (EVERYONE POST TO THIS)
    ... Removing Admin rights from your users is the prudent thing to do. ... without the IT Administrator providing these services and applications. ... priveledes, and before you know it, you have lost control of your network. ...
    (microsoft.public.win2000.security)