(Yes, I know it’s supposed to sign them in automatically. It doesn’t always. We’ve got tickets in. What does work every time is signing into Office when prompted.)
(Yes, I know it’s supposed to sign them in automatically. It doesn’t always. We’ve got tickets in. What does work every time is signing into Office when prompted.)
Why is the user allowed to install programs? That should be controlled by the administrator. Plus i don’t think citrix lets users install anything period. It’s been a few years since i used it but i seem to recall citrix images being immutable.
Users in general are too dumb to do the simplest things they are supposed to do even when you’re holding their hand while they are trying. But when it comes to doing things they aren’t supposed to do, and that are explicitly disabled, they will turn into geniuses and find a way.
That hasn’t been my experience in systems administration. If you set stuff up ptoperly the users can’t do anything you don’t want them to. If they do then they should get a job in penetration testing.
A lot of heavy lifting going on in those words…
Also, the malware which gets bundled with “free” versions of products usually doesn’t care if the install fails or succeeds, just that the user downloaded the package, unzipped it, and double-clicked on the ever-so-helpful “install.lnk”. Most of the current ransomware and infostealer malware doesn’t need local admin to do it’s damage. Plenty of Remote Access Toolkits (RATs) will run quite happily in user space. Users can edit their local RUN registry key and/or create scheduled tasks. And there are doubtless Privilege Escalation vulnerabilities sprinkled around the system like fairy dust when it gets to be time to dump the SAM hive or lsass memory space.
Yes, locking down local admin gets you a lot, in terms of security. It’s far from a trump card though. Lots and lots of damage can happen in user land.